semaphoreui has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was August 2026 with 3. The median CVSS is 8.8 (high), with 1 rated critical. None have a confirmed exploitation report. Most affected products: github.com/semaphoreui/semaphore (3), Semaphore UI (1), semaphore (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Products
- github.com/semaphoreui/semaphore 3
- Semaphore UI 1
- semaphore 1
Worst active — by depth score
CVE-2026-73292High· 8.3Semaphore UI is a web interface for managing DevOps tools58CVE-2026-73294Critical· 9.9Semaphore UI is a web interface for managing DevOps tools55CVE-2026-112305High· 8.8Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override49CVE-2026-73293High· 8.8Semaphore UI is a web interface for managing DevOps tools49CVE-2026-91994Medium· 6.5Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware48
semaphoreui vulnerabilities
CVEs affecting semaphoreui, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-112305High· 8.8Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST …
CVE-2026-91994Medium· 6.5PoCSemaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credenti…
CVE-2026-73294Critical· 9.9Semaphore UI is a web interface for managing DevOps tools
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/projec…
CVE-2026-73292High· 8.3PoCSemaphore UI is a web interface for managing DevOps tools
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-pa…
CVE-2026-73293High· 8.8Semaphore UI is a web interface for managing DevOps tools
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to cre…