CVE-2026-109131

Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Ansible Automation Platform UI Hub Collection Documentation

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description

The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders a documentation URL part (formatPartURL in DocumentationParsers.tsx) as a link without restricting the URL protocol/scheme. A collection whose documentation contains a link using a script-executing URL scheme can therefore cause script to run in the same origin as the Hub UI when another authenticated user views and activates that link in the collection documentation page. This is a stored cross-site scripting issue in shipped Platform UI code (present in the AAP 2.6 and 2.7 release branches).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109131

EUVD

EUVD-2026-102325

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Ansible Automation Platform 2 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-109131 is a stored cross-site scripting (XSS) vulnerability in the Red Hat Ansible Automation Platform UI. It occurs because the Hub collection module documentation renderer does not restrict URL protocols, allowing malicious collections to include links with script-executing schemes like javascript:. When an authenticated user views and clicks such a link, arbitrary script code executes within the same origin as the Hub UI.

Detection Guidance

To detect this vulnerability, inspect the Hub collection module documentation renderer in your Ansible Automation Platform UI for unsanitized URL schemes. Check if the formatPartURL function allows script-executing protocols like javascript:. Review collection documentation pages for suspicious links and monitor user reports of unexpected script execution.

Impact Analysis

This vulnerability could allow attackers to steal cookies, manipulate requests, or execute unauthorized commands. It requires an authenticated user to store a malicious payload and another authenticated user to click the crafted link. The impact includes potential compromise of user sessions or data within the Ansible Automation Platform UI.

Compliance Impact

This stored XSS vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Attackers could steal session cookies or manipulate user interactions to exfiltrate data, compromising confidentiality and integrity.

Mitigation Strategies

Apply patches or updates from Red Hat for AAP 2.6 and 2.7 branches. Temporarily restrict access to the Hub collection module documentation renderer until fixes are applied. Monitor Red Hat advisories for official mitigation steps and consider disabling or isolating affected components if updates are delayed.

Hi! I’m here to help you understand CVE-2026-109131. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70