Semaphore UI CVE-2026-112305

Exploitation requires an authenticated account bearing the task_runner role on a Semaphore UI instance at or below version 2.19.16, plus the ability to POST a task and supply arbitrary keys in the task environment JSON. The concrete trigger is injecting protected Ansible variables - specifically ansible_ssh_common_args carrying a ProxyCommand, or ansible_connection=local - which Semaphore passes through to Ansible unfiltered. Limiting factors: no path to exploitation without a valid task_runner credential (PR:L), so unauthenticated internet attackers cannot exploit it directly; impact is bounded to the Semaphore server user's privileges and the secrets/keys that process can reach. No special non-default configuration is otherwise needed, and no victim user interaction is required.

This is a credible, actionable priority rather than a CVSS-inflated non-issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 and is internally consistent with the description: a network-reachable web application where an authenticated low-privilege user (task_runner role, hence PR:L) can achieve full-impact remote code execution with no user interaction and low complexity. CWE-915 (improper modification of dynamically-determined attributes) matches the root cause precisely - unfiltered user-supplied keys override protected Ansible variables. Exploitation is confirmed-fixed by vendor PR #3888 and the flaw was reported by VulnCheck, a credible research source, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active exploitation or mass scanning; treat this as a high-value post-authentication privilege-escalation-to-RCE that an insider or a foothold-holding attacker would weaponize, not an internet-wide worm candidate. The main mitigating signal is PR:L: an attacker must already hold a task_runner account, which bounds the realistic attacker population to existing users or anyone who can obtain such credentials. No signals conflict; the chief missing data points are EPSS and POC status.

An attacker holding (or phishing/credential-stuffing into) a Semaphore account with the task_runner role submits a task whose environment JSON includes ansible_ssh_common_args with an embedded ProxyCommand, or sets ansible_connection=local. When Semaphore runs the task, Ansible executes the injected command as the Semaphore server process user, yielding arbitrary code execution and access to the server's encryption keys, stored SSH keys, and secrets. No public exploit code was identified at time of analysis, and low attack complexity plus no required user interaction make reliable exploitation straightforward once an account is obtained.