Update Semaphore UI to Mitigate CVE-2026-112305 RCE Vulnerability Affecting Task Runners and Server Secrets

Semaphore UI versions up to 2.19.16 contain a remote code execution vulnerability that allows users with the task_runner role to run arbitrary commands on the server. The flaw enables these users to override protected Ansible variables by supplying arbitrary keys in the task environment JSON structure during POST requests.

The risk

An attacker with the task_runner role can manipulate the task environment to set dangerous Ansible variables, such as ansible_ssh_common_args or ansible_connection=local. According to the NVD record for CVE-2026-112305, this manipulation allows the execution of commands as the Semaphore server user. This action can lead to the exposure of encryption keys, SSH keys, and other stored secrets residing on the server.

Who is exposed

Organizations running Semaphore UI versions prior to or including 2.19.16 are exposed to this risk. The vulnerability is tied to the application's handling of task environment inputs, specifically where it allows the modification of protected variables. Any user account granted the task_runner role within these affected versions possesses the capability to trigger the exploit.

Cost and compliance

The source material does not provide specific details regarding financial costs, regulatory compliance impacts, or industry-wide consequences associated with this vulnerability. No information is available regarding the number of organizations affected or the scale of potential data breaches resulting from CVE-2026-112305.

Our take on the response

Security teams should audit user permissions immediately, restricting the task_runner role to the minimum necessary staff. Since the flaw allows code execution as the server user, isolating the Semaphore instance from sensitive network segments can limit lateral movement. Monitoring for unusual Ansible variable overrides in task logs is critical for detection.

What defenders should look for

Teams usually monitor for anomalous task submissions that inject unexpected environment variables, particularly those related to SSH configurations or connection methods. Check whether logs show users setting ansible_ssh_common_args or ansible_connection to local, as these are indicators of exploitation attempts. Look for commands executing with server-level privileges that were not initiated by authorized administrators. Investigate any sudden access to sensitive credential files or encryption keys from within the task runner context.

What to do and how to stay safe: Semaphore UI

• Verify your current Semaphore UI version and compare it against the affected range up to 2.19.16.
• Review user accounts with the task_runner role and restrict access to only those who strictly require it.
• Monitor server logs for unauthorized command executions or unexpected Ansible variable modifications.
• Once the vendor provides an update, apply it immediately to close the remote code execution gap.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-112305?

The vulnerability has a CVSS score of 8.7, which is classified as high severity.

Which versions of Semaphore UI are affected?

All versions of Semaphore UI through 2.19.16 are affected by this remote code execution flaw.

How can an attacker exploit this vulnerability?

Attackers with the task_runner role can POST tasks with arbitrary keys to override protected Ansible variables.