Semaphore UI versions up to 2.19.16 allow users who possess the task_runner role to submit tasks with arbitrary keys in the task environment JSON. By overriding protected Ansible variables such as ansible_ssh_common_args with a ProxyCommand or setting ansible_connection to local, an attacker can execute commands as the Semaphore server operating system user. This enables disclosure of encryption keys, SSH credentials, and other stored secrets stored on the host. The flaw is a classic example of content control over privileged variable injection, corresponding to CWE‑915.

The vulnerability affects all installations of Semaphore UI version 2.19.16 and earlier. The product is provided by semaphoreui under the name "Semaphore UI."

The assessed CVSS score of 8.7 indicates a high severity RCE. The exploit requires remote access to the API endpoint that accepts task submissions and possession of a task_runner role. EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalog, but the severe CVSS rating combined with the broad applicability means a real-world exploitation risk exists for exposed instances. The attack vector is remote, initiated over HTTP by sending a crafted POST request. Mitigation measures must therefore address both API access controls and the validation of task environment variables.