SUSE CVE-2026-112305

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305 Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305 Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

EUVD-2026-104397

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305

Semaphore UI versions through 2.19.16 are vulnerable to remote code execution (RCE) due to an improperly controlled modification of dynamically-determined object attributes (CWE-915). Users with the task_runner role can override protected Ansible variables by injecting arbitrary keys into the tas...

CVE-2026-112305 Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

Semaphore UI input validation error vulnerability

Semaphore UI versions prior to 2.19.16 have a vulnerability in input validation. This vulnerability arises because users with the taskrunner role can provide arbitrary keys in the task environment JSON, thereby overriding protected Ansible variables. This allows them to set ansiblesshcommonargs’s...