Ansible automation-controller: ANSI OSC 8 sequences in job output become clickable javascript: links

Impact

The HTML view of job, ad hoc command, project update and inventory update stdout escapes HTML metacharacters but does not strip ANSI terminal escapes, so an OSC 8 hyperlink sequence is expanded into an anchor whose href is neither scheme-filtered nor escaped. A low-privileged user who can produce job output - or any external party whose data a playbook echoes - can plant a javascript: link; when an administrator views that output page and clicks it, the script runs in their authenticated session with no Content-Security-Policy to stop it. For a fleet operator this is a platform takeover path through the thing that holds the fleet's credentials: automation-controller is what reaches every GPU node with root-equivalent SSH and vault secrets, so an attacker acting as an admin there can push playbooks to the whole estate. Note that output echoed from an external system is enough - the attacker does not need an account.

Who can reach it

Network-reachable AAP web UI. Requires a low-privileged authenticated user who can run something that produces output, or merely the ability to influence data a playbook prints, plus a higher-privileged user clicking the planted link (NVD records UI:R).

What to do

Apply the Red Hat errata for your release train - RHSA-2026:71113 and RHSA-2026:71114 (AAP 2.5 on RHEL 8/9) and RHSA-2026:71177 and RHSA-2026:71179 - which means updating the automation-controller packages or containers and restarting the service; no fleet-wide node work. Until patched, tell administrators not to click links in job stdout and prefer the plain-text output view, and review recent job output for OSC 8 sequences if you suspect abuse.

References

Related entries

• Ansible automation-controller: log format template reads the Django secret key and DB passwordCVE-2026-84691 · Red Hat Ansible Automation Platform automation-controller (API 4XX log format-string template)High
• GitLab: stored XSS through merge request diff paths runs script in another user's sessionCVE-2026-84739 · GitLab CE/EE merge request diff viewer (path component sanitization)High
• Citrix NetScaler ADC/Gateway: Unauthenticated remote denial of service, actively exploitedCVE-2026-88779 · Citrix NetScaler ADC/GatewayHigh
• GitLab CE/EE: stored XSS via crafted repository content in syntax-highlighted outputCVE-2026-92883 · GitLab CE/EE (syntax-highlighted blob rendering, HTML attribute sanitization)High
• HPE iLO3/4/5: Remote unauthenticated denial of service against the management controllerCVE-2018-7093 · HPE iLO3/4/5High
• NAKIVO Backup & Replication: Unauthenticated absolute path traversal via getImageByPathCVE-2024-48248 · NAKIVO Backup & ReplicationHigh