Stored Cross-Site Scripting Vulnerability in Ansible Automation Platform
CVE-2026-109131

5.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2
Vendor
CVE Published:
15 October 2026

What is CVE-2026-109131?

The Ansible Automation Platform features a risk where the Hub collection module renders documentation URLs without validating the protocol or scheme used. This oversight enables a potential attacker to insert script-executing URLs, which can trigger unintended script execution in the browser of any authenticated user who clicks on such links. This vulnerability, located in the Platform UI's code, affects the 2.6 and 2.7 versions of the platform, posing significant risks to users through stored XSS attacks.

References

https://access.redhat.com/security/cve/CVE-2026-109131
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2549510
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.