A high-severity cross-site scripting vulnerability in Red Hat Ansible Automation Platform allows authenticated low-privileged users to achieve full platform takeover by targeting administrative sessions.

This is a stored cross-site scripting (XSS) flaw (CWE-79) residing in the automation-controller component. It occurs because the system fails to sanitize ANSI OSC 8 hyperlink sequences before rendering them in the HTML view of job and inventory updates, allowing a low-privileged authenticated user to inject malicious JavaScript.

The vulnerability poses a severe risk to organizational security by enabling unauthorized privilege escalation. By tricking a higher-privileged user into viewing manipulated job output, an attacker can execute arbitrary scripts within the context of the victim's session. This effectively grants the attacker the ability to perform any action the victim is authorized to take, potentially leading to a complete compromise of the Ansible automation infrastructure and sensitive deployment credentials. The CVSS score of 8.7 reflects the high impact on confidentiality and integrity, particularly given the elevated privileges often associated with platform administrators.

Immediate Action: Apply the vendor-provided security updates immediately as detailed in the relevant Red Hat Security Advisories (RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179). Ensure the platform is upgraded to version 4.6.33-1.el8ap, 4.6.33-1.el9ap, 4.7.17-1.el9ap, or the respective fixed build for versions 2.6 and 2.7.

Proactive Monitoring: Audit automation job logs for suspicious ANSI escape sequences or unexpected hyperlink structures that deviate from standard job output patterns.

Compensating Controls: Implement strict Content Security Policy (CSP) headers if the environment allows to restrict the execution of inline scripts, and restrict user access to job output generation until the patch is deployed.

Public Exploit Available: Unknown

Given the potential for full platform takeover, this vulnerability must be treated with high urgency. Administrators should prioritize the deployment of the official Red Hat patches across all affected RHEL environments. Until patching is complete, limit the ability of low-privileged users to trigger jobs or influence output that may be viewed by administrative personnel.