CVE-2026-106033 in Ansible Automation Platform
Summary
by MITRE • 10/06/2026
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's location.href without verifying its format or scheme. The platform includes built-in URL validation functions designed to block malicious URI schemes (such as javascript: and data:) as well as off-site or protocol-relative redirects, this specific route bypasses those controls. Consequently, an attacker can craft a malicious link that, when accessed by an authenticated user, causes arbitrary JavaScript to execute within the context of the user's session.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in the Ansible Platform UI represents a critical security flaw classified as DOM-based Cross-Site Scripting under CWE-79. This specific type of XSS differs from reflected or stored variants because the malicious script execution is triggered entirely within the client-side environment, specifically through the manipulation of the Document Object Model by untrusted data acting as an input to a sensitive sink function. In this instance, the vulnerability resides in the application's redirect route logic, where the system extracts a target destination URL from the next query parameter provided by the user and directly assigns it to the browser location.href property. This assignment acts as the primary sink for DOM-based XSS attacks, allowing any script embedded within that URL to execute with the privileges of the authenticated user currently viewing the page.
The root cause of this vulnerability is a failure in input validation and sanitization processes at the client-side level. Although the Ansible Platform includes built-in URL validation functions intended to block malicious URI schemes such as javascript: or data:, as well as preventing off-site redirects, this specific route bypasses those protective controls entirely. The application fails to verify the format, scheme, or origin of the target destination before processing it for navigation. This oversight allows an attacker to craft a specially constructed URL that contains executable JavaScript code within its query parameters. When an authenticated user clicks on this malicious link, their browser interprets the javascript: URI scheme and executes the embedded script immediately upon attempting to navigate to the specified location.
The operational impact of this vulnerability is severe due to the context in which it operates. Because the attack vector relies on social engineering or phishing tactics where a victim must click a crafted link, it targets authenticated users who have already passed initial authentication barriers. Once executed, the arbitrary JavaScript runs within the security context of the Ansible Platform domain. This grants the attacker full access to sensitive session data, including cookies and local storage tokens that are typically protected by HttpOnly flags but may still be accessible through other DOM APIs or if those protections are misconfigured. The attacker can perform actions on behalf of the victim, such as modifying configuration settings, exfiltrating sensitive inventory data, creating new administrative users, or pivoting to attack internal network resources reachable from the user's session. This effectively compromises the confidentiality and integrity of the Ansible Platform environment.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers, often used in phishing campaigns to steal credentials or deploy further malware. The exploitation method also relates to CWE-602, Client-Side Injection into DOM, highlighting the failure to properly sanitize user-supplied input before it is processed by browser APIs that can lead to code injection. To mitigate this risk, immediate remediation should focus on implementing strict allow-listing for redirect destinations rather than relying solely on block-lists of malicious schemes. Developers must ensure that all client-side navigation functions validate the target URL against a predefined list of trusted domains and enforce standard HTTP or HTTPS protocols while stripping any query parameters containing script tags or event handlers before assignment to location.href. Additionally, implementing Content Security Policy headers with strict directives regarding script sources can provide an additional layer of defense by preventing unauthorized JavaScript execution even if the DOM manipulation occurs successfully.