CVE-2026-112305

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible ssh common args with a ProxyCommand or ansible connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.