Skip to content
OpenAdvisories

Vendor

semaphoreui

5 known vulnerabilities.

Products

semaphore 4 Semaphore UI 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-112305

    Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

    Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_…

    semaphoreui Semaphore UI
  • High 8.8
    CVE-2026-73293

    Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

    Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager ro…

    semaphoreui semaphore github.com/semaphoreui/semaphore Go
  • High 8.3
    CVE-2026-73292 Public exploit

    Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

    Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, a…

    semaphoreui semaphore github.com/semaphoreui/semaphore Go