See how semaphore ui compares to other vendors in security performance
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or ansibleconnection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.