{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-84683", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-01T22:29:34.109Z", "datePublished": "2026-09-23T19:02:18.879Z", "dateUpdated": "2026-09-23T21:46:43.315Z"}, "containers": {"cna": {"title": "Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling session takeover", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. The HTML view of job, ad hoc command, project update, and inventory\nupdate standard output escapes HTML metacharacters but does not remove ANSI\nterminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink\nsequence in the output is expanded into an HTML anchor whose href is not scheme-\nfiltered or escaped, so a low-privileged user who can produce output -- or an\nexternal party whose data a playbook echoes -- can embed a javascript: link that\nis rendered into a text/html response with no Content-Security-Policy. When a\nhigher-privileged user views the output page and clicks the link, attacker-\ncontrolled JavaScript executes in their authenticated session, allowing actions\nas that user up to full platform takeover."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "automation-controller", "defaultStatus": "affected", "versions": [{"version": "0:4.7.17-1.el9ap", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el10", "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/controller-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"]}, {"vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-27/controller-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:71113", "name": "RHSA-2026:71113", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-84683", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527128", "name": "RHBZ#2527128", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-23T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "timeline": [{"lang": "en", "time": "2026-09-01T22:29:39.891Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-23T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-23T21:46:43.315Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2.6::el10", "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10", "cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9", "cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"], "defaultStatus": "affected", "packageName": "automation-controller", "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.7.17-1.el9ap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "defaultStatus": "affected", "packageName": "ansible-automation-platform-26/controller-rhel9", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "defaultStatus": "affected", "packageName": "ansible-automation-platform-27/controller-rhel9", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. The HTML view of job, ad hoc command, project update, and inventory\nupdate standard output escapes HTML metacharacters but does not remove ANSI\nterminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink\nsequence in the output is expanded into an HTML anchor whose href is not scheme-\nfiltered or escaped, so a low-privileged user who can produce output -- or an\nexternal party whose data a playbook echoes -- can embed a javascript: link that\nis rendered into a text/html response with no Content-Security-Policy. When a\nhigher-privileged user views the output page and clicks the link, attacker-\ncontrolled JavaScript executes in their authenticated session, allowing actions\nas that user up to full platform takeover."}], "id": "CVE-2026-84683", "lastModified": "2026-09-23T22:16:58.413", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "secalert@redhat.com", "type": "Secondary"}]}, "published": "2026-09-23T20:17:17.403", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:71113"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-84683"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527128"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:71113", "cpe": "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package": "automation-controller-0:4.7.17-1.el9ap", "product_name": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "release_date": "2026-09-23T00:00:00Z"}], "bugzilla": {"description": "automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout HTML view via ANSI OSC 8 hyperlink sequences (javascript: anchor) enabling session takeover", "id": "2527128", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527128"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-79", "details": ["A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. The HTML view of job, ad hoc command, project update, and inventory\nupdate standard output escapes HTML metacharacters but does not remove ANSI\nterminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink\nsequence in the output is expanded into an HTML anchor whose href is not scheme-\nfiltered or escaped, so a low-privileged user who can produce output -- or an\nexternal party whose data a playbook echoes -- can embed a javascript: link that\nis rendered into a text/html response with no Content-Security-Policy. When a\nhigher-privileged user views the output page and clicks the link, attacker-\ncontrolled JavaScript executes in their authenticated session, allowing actions\nas that user up to full platform takeover."], "name": "CVE-2026-84683", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-84683\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84683"], "statement": "This flaw affects automation-controller as shipped in Red Hat Ansible\nAutomation Platform. Exploitation requires an authenticated low-privileged user\nwho can produce job output (or an external party whose data a playbook echoes)\nto plant the payload, and a higher-privileged user to view the stdout HTML page\nand click the injected link; the impact is JavaScript execution in the viewer's\nauthenticated session, up to platform takeover.", "threat_severity": "Important"}

{"created": "2026-09-23T21:00:13.731667+00:00", "updated": "2026-09-23T21:00:13.731678+00:00", "vendors": []}