{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/semaphore-ui--2.19.16/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:semaphoreui:semaphore:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-112305"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Semaphore UI (\u003c= 2.19.16)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","vulnerability","webserver"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eSemaphore UI, a tool for managing Ansible tasks, contains a critical vulnerability (CVE-2026-112305) in versions up to 2.19.16 that enables Remote Code Execution (RCE). The vulnerability exists because the application does not properly restrict the modification of protected Ansible variables by users holding the 'task_runner' role.\u003c/p\u003e\n\u003cp\u003eAn attacker with authenticated access and the 'task_runner' role can send a crafted POST request containing a task environment JSON payload. By including keys such as 'ansible_ssh_common_args' with a malicious 'ProxyCommand' or by setting 'ansible_connection=local', the attacker can force the execution of arbitrary commands on the host system. The commands run with the privileges of the service user account executing the Semaphore UI process. Successful exploitation allows for full compromise of the application host, including the theft of stored credentials, SSH private keys, and encryption secrets.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the Semaphore UI platform as a user with the 'task_runner' role.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a new task via the web interface or API.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a task environment JSON object containing malicious Ansible configuration overrides.\u003c/li\u003e\n\u003cli\u003eAttacker sends a POST request to the Semaphore task creation endpoint with the malicious JSON payload.\u003c/li\u003e\n\u003cli\u003eThe Semaphore server processes the environment variables and passes the malicious 'ansible_ssh_common_args' or 'ansible_connection' to the Ansible runtime.\u003c/li\u003e\n\u003cli\u003eThe Ansible process executes the injected command (e.g., via 'ProxyCommand') on the underlying host.\u003c/li\u003e\n\u003cli\u003eAttacker gains arbitrary command execution under the context of the Semaphore service user.\u003c/li\u003e\n\u003cli\u003eAttacker exfiltrates stored SSH keys, environment secrets, and encryption keys from the server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in full remote code execution on the Semaphore UI server. Because Semaphore UI stores sensitive deployment data, this impact specifically includes the unauthorized access to and exfiltration of infrastructure encryption keys, SSH private keys for target servers, and potentially other stored application secrets. This poses a significant risk of lateral movement and full takeover of the managed infrastructure environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to the latest version of Semaphore UI immediately to patch CVE-2026-112305.\u003c/li\u003e\n\u003cli\u003eReview system audit logs for anomalous tasks initiated by users with the 'task_runner' role that include 'ansible_ssh_common_args' or 'ansible_connection' in the environment JSON.\u003c/li\u003e\n\u003cli\u003eAudit the permissions of all accounts currently assigned the 'task_runner' role and revoke access for any user not strictly requiring task execution capabilities.\u003c/li\u003e\n\u003cli\u003eRotate any SSH keys, credentials, or secrets stored within the affected Semaphore UI instance following remediation.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T18:08:37Z","date_published":"2026-10-19T18:08:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-semaphore-ui-rce/","summary":"Authenticated users with the task_runner role in Semaphore UI versions up to 2.19.16 can achieve remote code execution by injecting malicious Ansible configuration parameters into task environment payloads.","title":"Remote Code Execution in Semaphore UI via Ansible Environment Injection","url":"https://feed.craftedsignal.io/briefs/2026-10-semaphore-ui-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Semaphore UI (\u003c= 2.19.16)","version":"https://jsonfeed.org/version/1.1"}