CVE-2026-106033: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Red Hat Red Hat Ansible Automation Platform 2

This vulnerability in Red Hat Ansible Automation Platform 2 involves a DOM-based XSS flaw due to unvalidated input handling in the redirect route. The application extracts the target destination from the 'next' query parameter and assigns it directly to location.href without verifying the URL's format or scheme. Although the platform includes URL validation functions to block dangerous URI schemes and off-site redirects, this particular route bypasses those controls. An attacker can exploit this by sending a crafted link to an authenticated user, causing arbitrary JavaScript execution within that user's session context.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the context of an authenticated user's session. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-106033 for current remediation guidance. Until a fix is applied, avoid clicking on untrusted links containing the 'next' parameter in the Ansible Automation Platform UI. Monitor vendor updates for official patches or workarounds.