Ansible Automation Platform EUVD-2026-102325

Requires an authenticated user with permission to publish/upload a collection to Automation Hub, whose collection documentation contains a link using a script-executing URL scheme (such as javascript:) - the renderer does not restrict the URL protocol/scheme. Exploitation further requires a second authenticated user to open the affected collection's documentation page AND actively click/activate the malicious link (not merely view it). Limiting factors: both publish access and victim interaction are needed, the issue is stored (not reflected), and it is confined to deployments running the unified AAP UI Hub documentation renderer on the 2.6 or 2.7 release branches.

This is a moderate-severity stored XSS (CWE-79) with a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The signals are internally consistent and point to a genuine but constrained risk rather than an urgent emergency. The vector requires some privileges (PR:L - an authenticated user able to publish/upload a collection) and victim interaction (UI:R - a second authenticated user must view and activate the malicious link), which meaningfully limits mass exploitation. The scope change (S:C) and low confidentiality/integrity impact reflect script executing in the Hub UI origin against another user's session, capable of session/credential theft or limited action-on-behalf, but not direct system compromise. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a defense-in-depth fix rather than a drop-everything patch. No signals are conflicting; the main caveat is that affected-version precision and any fix version are not available from the two Red Hat references provided (the Bugzilla and the Red Hat CVE page), so patch status must be verified directly with Red Hat.

A low-privileged but authenticated AAP user publishes an Ansible collection to the Hub whose documentation embeds a link using a script-executing URL scheme (e.g. javascript:). When an administrator or other authenticated user browses that collection's documentation page and clicks the crafted link, attacker-controlled script executes in the Hub UI origin under the victim's session. No public exploit code was identified in the provided data, so exploitation would currently require an attacker to craft the malicious collection themselves.