CVE-2026-91994: Semaphore UI Information Disclosure Flaw

CVE-2026-91994 Overview

CVE-2026-91994 is a missing authorization vulnerability [CWE-862] affecting Semaphore UI through version 2.19.12. The GetMustCanMiddleware function exempts HTTP GET and HEAD requests from project resource permission checks. Low-privileged users assigned guest or task_runner roles can read all project environments through the environment endpoint. Retrieved data includes plaintext secrets, credentials, and passwords stored within project environments. The flaw provides an authenticated read primitive against sensitive automation data managed by Semaphore. It affects deployments where multiple roles share project access under the assumption that non-privileged roles cannot view secret material.

Critical Impact
Authenticated attackers with the lowest project roles can exfiltrate plaintext secrets, credentials, and passwords stored in Semaphore project environments through simple GET requests.

Affected Products

Semaphore UI versions through 2.19.12
Deployments using role-based access control with guest or task_runner roles
Self-hosted Semaphore instances managing infrastructure automation secrets

Discovery Timeline

2026-09-15 - CVE-2026-91994 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91994

Vulnerability Analysis

Semaphore UI enforces project resource permissions through the GetMustCanMiddleware function defined in api/projects/project.go. The middleware is registered against project routes in api/router.go. The implementation contains a conditional branch that skips authorization when the HTTP method is GET or HEAD. The design assumes read operations do not require enforcement of resource-level permissions.

This assumption fails for the environment endpoint. Project environments in Semaphore store secret variables, API tokens, SSH credentials, and passwords used by ansible playbooks and task runners. When a guest or task_runner role holder issues a GET request to the environment endpoint, the middleware returns without checking whether the role permits reading secrets. The handler then serves the full environment payload including plaintext secret values.

Root Cause

The root cause is a missing authorization check [CWE-862] in the request path for safe HTTP methods. The middleware conflates read operations with public or low-sensitivity operations. The environment resource is read-sensitive because it holds secret material, yet the middleware exempts reads from role validation.

Attack Vector

Exploitation requires network access to the Semaphore UI API and valid credentials for any project role, including guest or task_runner. The attacker authenticates, obtains a valid session or API token, and issues GET requests against the project environment endpoint. The server returns environment objects containing plaintext secrets without further checks. No user interaction is required beyond the attacker's own request. Refer to the VulnCheck Advisory on Semaphore UI and the affected middleware source for the vulnerable code path.

Detection Methods for CVE-2026-91994

Indicators of Compromise

GET requests to /api/project/{id}/environment originating from accounts assigned guest or task_runner roles.
Repeated environment endpoint access from a single low-privileged account across multiple project IDs.
Session tokens for non-administrative users appearing in API access logs targeting environment resources.

Detection Strategies

Correlate API access logs with role assignments and flag environment endpoint reads by any role other than admin or manager.
Baseline typical environment endpoint traffic per user and alert on volumetric anomalies from low-privileged accounts.
Deploy web application firewall rules that inspect the requesting user's role claim against the accessed resource path.

Monitoring Recommendations

Enable verbose HTTP access logging on the Semaphore reverse proxy and forward logs to a centralized analytics platform.
Rotate and monitor use of any secret that may have been exposed to non-privileged Semaphore users prior to patching.
Track authentication events for guest and task_runner accounts and alert on new access patterns targeting sensitive endpoints.

How to Mitigate CVE-2026-91994

Immediate Actions Required

Restrict network access to the Semaphore UI to trusted administrators until a patched release is deployed.
Audit all project role assignments and remove unnecessary guest and task_runner accounts.
Rotate all secrets, credentials, SSH keys, and API tokens stored in Semaphore project environments.

Patch Information

At time of publication, the vulnerability is documented against Semaphore UI through version 2.19.12. Monitor the Semaphore GitHub repository and Issue #4150 for a fixed release. Upgrade to the first release that enforces project resource permission checks on GET and HEAD requests.

Workarounds

Remove all guest and task_runner role assignments from projects that store sensitive environment variables.
Move high-value secrets to an external secret manager and reference them at runtime rather than storing them in Semaphore environments.
Place Semaphore behind an authenticating reverse proxy that enforces additional access controls on the environment endpoint path.

bash

# Example nginx location block restricting environment endpoint access
location ~ ^/api/project/[0-9]+/environment {
    allow 10.0.0.0/24;   # administrative subnet
    deny all;
    proxy_pass http://semaphore_backend;
}