CVE-2026-73294: Semaphore UI RCE Vulnerability

CVE-2026-73294 Overview

CVE-2026-73294 is a command injection vulnerability in Semaphore UI, a web interface for managing DevOps tools such as Ansible, Terraform, and OpenTofu. The flaw resides in repository git_url handling, where an attacker-controlled --upload-pack option is passed to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and during scheduled commit-hash polling. Any authenticated user with the project Manager or Owner role can execute arbitrary operating system commands in the context of the Semaphore server process. The issue affects all versions prior to 2.18.17 and 2.19.5-beta2, and is classified under [CWE-78] OS Command Injection.

Critical Impact
Authenticated project Managers or Owners can achieve arbitrary OS command execution on the Semaphore server, leading to full compromise of the DevOps automation host and any credentials it holds.

Affected Products

Semaphore UI versions prior to 2.18.17
Semaphore UI 2.19.x versions prior to 2.19.5-beta2
Semaphore server deployments exposing the project repositories API

Discovery Timeline

2026-08-12 - CVE-2026-73294 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73294

Vulnerability Analysis

Semaphore UI accepts a repository git_url value from authenticated project Managers or Owners and forwards it, unvalidated, to the git binary as a positional argument. The CmdGitClient.GetLastRemoteCommitHash function invokes git to resolve the latest commit hash for a configured repository. Because Go's os/exec passes arguments directly to the executable rather than through a shell, exploitation does not require shell metacharacters. Instead, an attacker abuses git's own argument parser by supplying a value that begins with a dash.

The malicious value --upload-pack=/path/to/script is interpreted by git as the --upload-pack option, which specifies an alternative program to invoke on the remote side of a fetch. When git executes this program locally as part of the transport negotiation, the attacker's chosen binary or script runs with the privileges of the Semaphore server process. The condition is triggered both on repository creation and on the recurring scheduled commit-hash polling loop, providing multiple execution paths.

Root Cause

The root cause is missing input validation on repository URLs before they are handed to git as command-line arguments. Semaphore did not distinguish between legitimate URL schemes (https://, ssh://, git://, file://, scp-style user@host:path, or local paths) and values that git would parse as options. Any string beginning with - is treated as a flag rather than a repository location, enabling git option injection.

Attack Vector

Exploitation requires the attacker to hold a project Manager or Owner role on any project within a targeted Semaphore instance. The attacker submits a crafted repository via POST /api/project/{id}/repositories with a git_url such as --upload-pack=/tmp/payload.sh. When Semaphore polls the repository for its latest commit hash, git invokes the attacker-supplied script, yielding arbitrary command execution in the Semaphore server process.

// Security patch in db/git_url.go - fix(git): validate url
+package db
+
+import "strings"
+
+// ValidateGitURL rejects repository URLs that git would interpret as a
+// command-line option instead of a repository location. The CmdGitClient
+// passes the URL to the git binary as a positional argument, so a value
+// beginning with "-" (e.g. "--upload-pack=/path/to/script") would be parsed
+// by git as an option and could lead to arbitrary command execution
+// (git option injection). Legitimate git URLs (https://, ssh://, git://,
+// file://, scp-like user@host:path, or local filesystem paths) never begin
+// with "-", so rejecting them here is safe.
+func ValidateGitURL(url string, objectName string) error {
+	if strings.HasPrefix(strings.TrimSpace(url), "-") {
+		return NewValidationError(objectName + " url is invalid")
+	}
+
+	return nil
+}

Source: GitHub commit 7e8a9434

Detection Methods for CVE-2026-73294

Indicators of Compromise

Repository records in the Semaphore database whose git_url field begins with - or contains substrings such as --upload-pack, --exec, or --config.
Unexpected child processes spawned by the Semaphore server process, particularly git invocations followed by shell interpreters or scripts written to world-writable directories.
Outbound network connections or file writes originating from the Semaphore host that do not correspond to configured playbook runs.

Detection Strategies

Inspect application logs and API access logs for POST /api/project/{id}/repositories and repository update calls carrying git_url values that begin with -.
Correlate scheduled commit-hash polling events with process-execution telemetry on the Semaphore host to identify anomalous git command lines.
Audit project role assignments to identify unexpected accounts holding Manager or Owner privileges, which are prerequisites for exploitation.

Monitoring Recommendations

Enable process command-line auditing on Semaphore servers and alert on git invocations with argument strings containing --upload-pack=, --exec=, or --config=.
Forward Semaphore application logs and host process telemetry to a centralized analytics platform for retrospective hunting across the exposure window.
Monitor for new outbound network sessions or filesystem changes initiated by the Semaphore service account outside of scheduled task windows.

How to Mitigate CVE-2026-73294

Immediate Actions Required

Upgrade Semaphore UI to version 2.18.17 or 2.19.5-beta2, which introduce the ValidateGitURL check that rejects URLs beginning with -.
Review all existing repository configurations and remove or correct any entry whose git_url starts with - or embeds a git option.
Restrict project Manager and Owner role assignments to trusted operators, and rotate any credentials, tokens, or SSH keys that were accessible to the Semaphore server process.

Patch Information

The maintainers released fixes in Semaphore v2.18.17 and Semaphore v2.19.5-beta2. Technical details are documented in the GitHub Security Advisory GHSA-xp7j-h7jc-4w8p. The corresponding commits are 7e8a9434 and a7a7a33a, which add the ValidateGitURL function and invoke it during repository validation.

Workarounds

If immediate patching is not possible, place Semaphore behind a reverse proxy that inspects and rejects POST /api/project/{id}/repositories requests containing git_url values that start with -.
Temporarily revoke Manager and Owner roles from non-administrative accounts until the upgrade is applied.
Run the Semaphore process under a dedicated, unprivileged service account with no access to sensitive credentials or infrastructure keys.

bash

# Configuration example: verify installed Semaphore version and upgrade
semaphore --version

# Docker deployments: pull the patched image and redeploy
docker pull semaphoreui/semaphore:v2.18.17
docker stop semaphore && docker rm semaphore
docker run -d --name semaphore semaphoreui/semaphore:v2.18.17

# Database audit: identify suspicious repository URLs prior to upgrade
# (adjust for your database backend; example shown for PostgreSQL)
psql -d semaphore -c "SELECT id, project_id, name, git_url FROM project__repository WHERE git_url LIKE '-%';"