CVE-2026-73292

CVE-2026-73292 is a CSRF vulnerability in Semaphore UI allowing password changes without current-password verification. The CVSS 8.3 score likely understates actual risk because Semaphore isn't a typical web app—it's a DevOps control plane managing CI/CD pipelines, often with embedded cloud provider credentials. When an attacker uses CSRF to seize an admin account here, they're not just accessing a dashboard; they're positioned to modify pipelines, inject code into deployment processes, or exfiltrate secrets. The blast radius extends into every infrastructure target Semaphore can reach. The absence of current-password confirmation compounds the issue significantly. Traditional CSRF requires tricking a logged-in user into visiting a malicious page—a moderately high bar. But without verifying the requester knows the existing password, the attack surface expands to any scenario where an authenticated session exists, including stale or abandoned sessions. In CI/CD environments where session cookies may persist longer than typical web apps and are sometimes embedded in scripts or CI configurations, this creates a realistic exposure window far exceeding normal web session lifetimes. Check whether your Semaphore deployment exposes the admin interface externally or only to internal networks, and assess whether it holds privileged cloud credentials that would make this a high-value target. The fix in version 2.18.21 should be examined to determine whether it added CSRF tokens, current-password confirmation, or both—and whether other password-related endpoints share the same vulnerability pattern. If your deployment predates 2.18.21, treat it as a priority update: the vulnerability represents a known flawed trust model that may have operated for months or years, and any attacker achieving session compromise can examine pipeline history and artifacts built under that assumption.

Reviewed through automated stages and approved by a human before publication.