Ansible Automation Platform CVE-2026-106033

Exploitation requires the specific redirect route of the Ansible Platform UI that reads the 'next' query parameter and assigns it to location.href without applying the platform's built-in URL/scheme validation (the validation that normally blocks javascript:, data:, off-site, and protocol-relative redirects). The attack is limited by two concrete factors: (1) the victim must already be an authenticated user of the Ansible Platform UI (PR:L), and (2) the victim must actively click the attacker-supplied link (UI:R) - it cannot be triggered automatically against a passive or unauthenticated target. No special server configuration toggle is described; the flaw stems from this one route bypassing the otherwise-present validation controls.

This is a moderate, not top-priority, issue. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects the realistic constraints: although network-reachable and low-complexity, exploitation requires an already-authenticated victim (PR:L in the vendor vector) AND active user interaction (UI:R) - the victim must click an attacker-crafted link while logged into the Ansible Platform UI. The scope change (S:C) and Low confidentiality/integrity impact correctly capture that injected JavaScript runs in the victim's browser session rather than compromising the server directly. No EPSS score, no CISA KEV entry, and no public proof-of-concept were provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is a vendor-reported (Red Hat) defect rather than a signal-rich, widely-exploited threat. The signals are internally consistent - there is no conflict between a network vector and the described browser-side DOM XSS. Net: patch as part of normal cycles for internet-facing or multi-user deployments, but this does not warrant emergency, out-of-band remediation absent new exploitation signals.

An attacker crafts a malicious link to the Ansible Platform UI redirect route, embedding a javascript: or similar payload in the 'next' query parameter, and sends it (via phishing/chat) to an authenticated operator. When the logged-in user clicks it, the unvalidated value is assigned to location.href and arbitrary JavaScript executes in their authenticated session, enabling session-context actions or data theft. No public proof-of-concept was identified at the time of analysis.