Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter

Summary

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's location.href without verifying its format or scheme. The platform includes built-in URL validation functions designed to block malicious URI schemes (such as javascript: and data:) as well as off-site or protocol-relative redirects, this specific route bypasses those controls. Consequently, an attacker can craft a malicious link that, when accessed by an authenticated user, causes arbitrary JavaScript to execute within the context of the user's session.

Timeline

1. Oct 6, 2026, 6:18 PM UTCCVE published
2. Oct 6, 2026, 7:25 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 16, 2026, 9:46 AM UTCRecord last updated

Affected versions

• ansible-automation-platform-24/lightspeed-rhel8

  Version range not reported

• ansible-automation-platform-25/lightspeed-rhel8

  Version range not reported

• ansible-automation-platform-26/gateway-rhel9

  Version range not reported

• ansible-automation-platform-27/gateway-rhel9

  Version range not reported

• automation-controller

  Version range not reported

• automation-eda-controller

  Version range not reported

• automation-gateway

  Version range not reported

• automation-platform-ui

  Version range not reported

• ansible-packaging

  Version range not reported

References 2