DOM-based Cross-Site Scripting Vulnerability in Ansible Platform UI
CVE-2026-106033

5.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2
Red Hat Hardened Images
Vendor
CVE Published:
6 October 2026

What is CVE-2026-106033?

A DOM-based Cross-Site Scripting (XSS) vulnerability has been identified in the Ansible Platform UI, stemming from inadequate validation of input parameters during redirection. The application extracts the destination from the 'next' query parameter and assigns it directly to the 'location.href' of the browser without sufficient checks on its format or scheme. While the platform has measures to prevent harmful URI schemes (including 'javascript:' and 'data:') and restrict off-site redirects, this particular redirect route circumvents those protections. This flaw enables attackers to create malicious links that, when opened by authenticated users, can execute harmful JavaScript code within the users' session context.

References

https://access.redhat.com/security/cve/CVE-2026-106033
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2546603
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Shashank (CredShields) for reporting this issue.
.