CVE-2026-84683

Awaiting Analysis Awaiting Analysis - Queue

HTML Anchor Injection in Red Hat Ansible Automation Platform

Publication date: 2026-09-23

Last updated on: 2026-09-25

Assigner: redhat-SADP

Description

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink sequence in the output is expanded into an HTML anchor whose href is not scheme- filtered or escaped, so a low-privileged user who can produce output -- or an external party whose data a playbook echoes -- can embed a javascript: link that is rendered into a text/html response with no Content-Security-Policy. When a higher-privileged user views the output page and clicks the link, attacker- controlled JavaScript executes in their authenticated session, allowing actions as that user up to full platform takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-25

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-84683

EUVD

EUVD-2026-85571

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	ansible_automation_platform	*
red_hat	ansible_automation_platform	From 2.6 (inc)
red_hat	ansible_automation_platform	From 2.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Red Hat Ansible Automation Platform's automation-controller. It occurs when ANSI OSC 8 hyperlink sequences in job output are converted to HTML anchor tags without proper filtering. Attackers can inject malicious JavaScript links that execute when higher-privileged users view the output page, potentially leading to session hijacking or full platform takeover.

Detection Guidance

This vulnerability is specific to the HTML view of job outputs in Red Hat Ansible Automation Platform's automation-controller. Detection requires checking for ANSI OSC 8 hyperlink sequences in job outputs that may contain javascript: links. Review job stdout logs for suspicious HTML anchor tags with javascript: href attributes. No direct commands are provided in the context, but monitoring job outputs for unexpected HTML content is recommended.

Impact Analysis

If you are a higher-privileged user in Ansible Automation Platform, clicking a malicious link in job output could execute attacker-controlled JavaScript in your authenticated session. This may allow attackers to perform actions as you, up to full platform takeover. Low-privileged users could plant the payload, while external parties might inject data via playbooks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. A successful attack may expose personal or health information, resulting in compliance breaches, legal penalties, and reputational damage for organizations using the affected platform.

Mitigation Strategies

Upgrade to a fixed version of Red Hat Ansible Automation Platform: version 2.6 for RHEL 10 and RHEL 9 via RHSA-2026:71113, or version 2.5 for RHEL 9 and RHEL 8 via RHSA-2026:71114. If immediate upgrading is not possible, apply available mitigations as advised by Red Hat. Restrict low-privileged user access to job output generation until patched.

Hi! I’m here to help you understand CVE-2026-84683. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70