CVE-2026-112305: fallo de gravedad alta en semaphoreui Semaphore UI
Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.6%
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
semaphoreui · Semaphore UIReferencias
https://github.com/semaphoreui/semaphorehttps://github.com/semaphoreui/semaphore/blob/v2.19.16/api/projects/tasks.go#L39-L75https://github.com/semaphoreui/semaphore/blob/v2.19.16/services/tasks/TaskRunner.go#L395-L431https://github.com/semaphoreui/semaphore/pull/3888https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.16-rce-via-task-environment-ansible-variable-override