Semaphore UI: task_runner users override Ansible connection vars to run code as the server user

Impact

Semaphore UI is the web front end teams use to run Ansible playbooks against a fleet, so it holds the SSH keys and vault secrets for every node it manages. A user with only the task_runner role can POST a task whose environment JSON sets protected variables such as ansible_ssh_common_args (with a ProxyCommand) or ansible_connection=local, and the command runs as the Semaphore server user instead of on the intended target. That yields the encryption key, the stored SSH private keys and every secret in the Semaphore database - which in a GPU fleet is the credential set for provisioning and reconfiguring the nodes themselves. A low-privilege operator account becomes full control of the automation plane.

Who can reach it

Any authenticated Semaphore user holding the task_runner role, reaching the Semaphore HTTP API over the network. No admin rights needed.

What to do

Upgrade past 2.19.16 (fix is in PR #3888 in the semaphoreui/semaphore repository); the advisory does not name a released fixed version, so track the release carrying that PR. Rollout is a single daemon restart - no node drain. Until then, treat task_runner as equivalent to server admin: remove it from any account that should not hold the SSH and vault keys, and rotate the Semaphore encryption key and stored SSH keys if the role was broadly granted.

References

Related entries

• GitLab CE/EE: stored XSS in analytics dashboard pagination controlsCVE-2026-15216 · GitLab CE/EE (analytics dashboard pagination controls)High
• GitLab CE/EE: stored XSS in analytics dashboard table cell renderingCVE-2026-15217 · GitLab CE/EE (analytics dashboard table cell rendering)High
• Sigstore Fulcio: OIDC discovery follows cross-host redirects and leaks ServiceAccount tokensCVE-2026-49478 · Sigstore Fulcio (OIDC discovery HTTP client, cross-host redirects)High
• Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD and LIP-ME201C (through 8.4.18, LINX-A64): An out-of-boundsCVE-2026-55732 · Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD and LIP-ME201C (through 8.4.18, LINX-A64)High
• Netty: OpenSSL client path silently skips TLS hostname verification on Java 25+CVE-2026-62243 · Netty io.netty:netty-handler (SslProvider.OPENSSL client-side hostname verification)High
• Pure Storage FlashArray Purity (data path information exposure): Insufficient filtering on certain data paths exposesCVE-2026-6445 · Pure Storage FlashArray Purity (data path information exposure)High