CVE-2026-84232: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Red Hat Red Hat Ansible Automation Platform 2

CVE-2026-84232 is a stored cross-site scripting vulnerability in pulpcore's content serving application component of Red Hat Satellite. Files uploaded to pulp_file repositories are served with their original content type and without a Content-Disposition: attachment header, allowing malicious HTML or SVG files containing JavaScript to execute in the browser of any user accessing the file URL. The vulnerability requires authenticated users with upload permissions. The XSS is effective because the /pulp/content/ path shares the same origin as the Satellite web UI, enabling script execution in the context of the host application. The session cookie is protected with HttpOnly, preventing direct session token theft, but the attacker can read visible page content and perform authenticated API requests via the victim's browser session. Red Hat Ansible Automation Platform and RHUI are not affected as they do not use pulp_file repositories. Red Hat rates this as a Moderate severity issue with a CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

The vulnerability allows an authenticated user with upload permissions to execute stored XSS attacks against other users who visit the malicious file URL within Red Hat Satellite. The impact includes reading visible page content and making authenticated API requests on behalf of the victim. Direct session token theft is prevented by the HttpOnly flag on cookies. There is no impact on availability. The vulnerability is limited to Red Hat Satellite and does not affect Ansible Automation Platform or RHUI. The attack surface is limited by the requirement for upload permissions and user interaction to visit the malicious content URL.

Red Hat provides official mitigation guidance. If immediate patching is not possible, administrators should configure the Apache reverse proxy for the /pulp/content/ path to add security headers that force content downloads and block script execution: set Content-Disposition to "attachment", X-Content-Type-Options to "nosniff", and a restrictive Content-Security-Policy with sandboxing. Restart Apache after configuration changes. Alternatively, restrict file upload permissions to trusted users only. Check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-84232 for updates on patches or official fixes. Patch status is not explicitly confirmed in the advisory, so verify current remediation guidance there.