REDHAT-BUG-2546603: XSS

Published Oct 6, 2026

Updated

DOM-based cross-site scripting (XSS) vulnerability in the Ansible Platform UI's /redirect route (project: ansible/ansible-ui, affected component: platform/main/Redirect.tsx). The vulnerable Redirect component and /redirect route were introduced in commit df1902cc on 2024-04-23, and the upstream devel branch still pointed to the confirmed UI commit as of 2026-10-06. The root cause is that the next query parameter in Redirect.tsx flows directly to location.href without validation, even though the UI already provides a validateUrlPath helper (in frontend/common/AnsibleLogin/validateUrlPath.ts) that rejects javascript:, data:, absolute, and protocol-relative URLs — this helper is used by the login component but is not applied to the Redirect component, which is registered in usePlatformNavigation.tsx and exposed to authenticated users behind PlatformLogin after a valid Gateway session.

Affected Software

1 affected component

Ansible Ansible Platform UI

Event History

Oct 6, 2026

Data Sourced

via Red Hat·01:53 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can reach the vulnerable route?

The /redirect route is exposed to authenticated users after PlatformLogin when they have a valid Gateway session. It is registered through usePlatformNavigation.tsx.

What does an attacker need to exploit this issue?

An attacker needs to cause an authenticated user to use the /redirect route with a crafted next query parameter. The parameter is assigned directly to location.href without validation.

Are external or script-based redirect targets blocked?

No validation is applied by the vulnerable Redirect component. The existing validateUrlPath helper, which rejects javascript:, data:, absolute, and protocol-relative URLs, is used by the login component but not by this route.

How can I determine whether my UI contains the vulnerable code?

Check whether the deployed UI includes the Redirect component and /redirect route introduced in commit df1902cc. Also verify whether Redirect.tsx validates the next parameter with validateUrlPath before assigning it to location.href.

REDHAT-BUG-2546603: XSS

Affected Software

Event History

Frequently Asked Questions

Who can reach the vulnerable route?

What does an attacker need to exploit this issue?

Are external or script-based redirect targets blocked?

How can I determine whether my UI contains the vulnerable code?

Company

Resources

Contact

Frequently Asked Questions

Who can reach the vulnerable route?

What does an attacker need to exploit this issue?

Are external or script-based redirect targets blocked?

How can I determine whether my UI contains the vulnerable code?