CVE-2026-84683: Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling session takeover

Published Sep 1, 2026

Updated

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink sequence in the output is expanded into an HTML anchor whose href is not scheme- filtered or escaped, so a low-privileged user who can produce output -- or an external party whose data a playbook echoes -- can embed a javascript: link that is rendered into a text/html response with no Content-Security-Policy. When a higher-privileged user views the output page and clicks the link, attacker- controlled JavaScript executes in their authenticated session, allowing actions as that user up to full platform takeover.

Affected Software

1 affected component

Red Hat automation-controller

Event History

Sep 1, 2026

Data Sourced

via Red Hat·10:34 PM

DescriptionSeverityAffected Software

Sep 23, 2026

CVE Published

via MITRE·07:02 PM

Data Sourced

via MITRE·07:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs the ability to cause ANSI OSC 8 hyperlink sequences to appear in job, ad hoc command, project update, or inventory update standard output. This can be through a low-privileged account that can produce output, or through external data that a playbook echoes.

Is exploitation automatic when malicious output is generated?

No. A higher-privileged user must view the affected HTML output page and click the attacker-controlled link. The link can use a javascript: URI, causing code to execute in the viewer's authenticated session.

Who is most exposed?

Higher-privileged users who review HTML-formatted stdout from jobs, ad hoc commands, project updates, or inventory updates are exposed if that output can be influenced by lower-privileged users or untrusted external data. Successful exploitation can permit actions as the viewing user, up to full platform takeover.

How can teams identify potentially affected output?

Review affected stdout sources for ANSI OSC 8 hyperlink escape sequences, especially in output generated by lower-privileged users or from playbooks that echo externally supplied data. The vulnerable behavior occurs when such sequences are converted into clickable anchors in the HTML stdout view.

CVE-2026-84683: Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling session takeover

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Is exploitation automatic when malicious output is generated?

Who is most exposed?

How can teams identify potentially affected output?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Is exploitation automatic when malicious output is generated?

Who is most exposed?

How can teams identify potentially affected output?