CVE-2026-112305: Improperly Controlled Modification of Dynamically-Determined Object Attributes in semaphoreui Semaphore UI

CVE-2026-112305 is a remote code execution vulnerability in Semaphore UI through version 2.19.16. It arises from improper control over modification of dynamically-determined object attributes. Specifically, users with the task_runner role can override protected Ansible variables by injecting arbitrary keys into the task environment JSON. By POSTing tasks that set ansible_ssh_common_args with a ProxyCommand or ansible_connection=local, attackers can execute commands with the privileges of the Semaphore server user, leading to exposure of sensitive secrets including encryption and SSH keys.

Successful exploitation allows attackers with task_runner privileges to execute arbitrary commands on the Semaphore server, potentially leading to full compromise of the server environment. This includes exposure of encryption keys, SSH keys, and other stored secrets, which can further escalate access or compromise confidentiality and integrity of managed systems.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict task_runner role assignments to trusted users only and monitor for suspicious task submissions.