CVE-2026-112305

Semaphore UI versions through 2.19.16 are vulnerable to remote code execution (RCE) due to an improperly controlled modification of dynamically-determined object attributes (CWE-915). Users with the task_runner role can override protected Ansible variables by injecting arbitrary keys into the tas...