CVE-2026-84683 describes a cross-site scripting (XSS) vulnerability in the automation-controller component of Red Hat Ansible Automation Platform. The issue arises because the HTML view of job output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before converting output to HTML. This allows an ANSI OSC 8 hyperlink sequence to be expanded into an HTML anchor tag with an unfiltered and unescaped href attribute. Consequently, a low-privileged user or an external party whose data is echoed by a playbook can embed a javascript: URI link. When a higher-privileged user views the output and clicks the link, the attacker's JavaScript runs within their authenticated session, enabling actions up to full platform compromise.

Successful exploitation allows an attacker with low privileges to execute arbitrary JavaScript in the context of a higher-privileged user's session. This can lead to full platform takeover, including unauthorized actions performed with the higher-privileged user's rights. The vulnerability impacts confidentiality and integrity of the platform and its managed automation tasks.

An official security update is available from Red Hat for Ansible Automation Platform 2.6 that addresses this vulnerability. Users should apply the update as per Red Hat Advisory RHSA-2026:71113. No additional mitigation steps are indicated by the vendor advisory beyond applying the official fix.