CVE-2026-112305 in Semaphore UI
Riassunto
di MITRE • 19/10/2026
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.