CVE-2026-106033

Executive Summary

CVE-2026-106033 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the Ansible Platform UI, residing in an application redirect route that reads a target destination from the next query parameter and assigns it to the browser's location.href without validating its format or scheme. The platform ships built-in URL validation functions intended to block dangerous URI schemes (javascript:, data:) and off-site or protocol-relative redirects, but this specific route bypasses those controls. An authenticated user who clicks a crafted link will execute arbitrary JavaScript in the context of their session, enabling session-context actions such as data theft, request forgery against the platform, or UI redressing — mitigated by the requirement for user interaction and low privilege level.

Technical Analysis

This is a DOM-based XSS (CWE-79) vulnerability. The defining characteristic of DOM-based XSS is that the injection and the execution both occur entirely within the client-side DOM: the source (the untrusted next query parameter) is read by JavaScript running in the page, and the sink (location.href) is written to directly by that same JavaScript. No server-side reflection is required, and the malicious payload does not need to traverse the server at all. This has direct detection consequences: server-side request logs may only show a benign-looking navigation to the redirect route carrying an encoded next value, while the actual execution happens in the browser.

The vulnerability mechanism, as documented, is a control bypass rather than a missing feature. The Ansible Platform UI already implements "built-in URL validation functions designed to block malicious URI schemes (such as javascript: and data:) as well as off-site or protocol-relative redirects." The defect is that the specific redirect route handling the next parameter does not invoke — or does not correctly apply — those validation functions before assigning the value to location.href. The result is that a scheme such as javascript: (or another executable scheme that the global validators would normally reject) survives into the navigation sink. Because the sink is location.href, the browser treats the supplied value as a navigation target; when the value carries a script-capable scheme, the browser executes it in the origin of the currently loaded Ansible UI page.

Attack surface: the redirect route of the Ansible Platform UI, reachable over the network (AV:N) and requiring the victim to be authenticated to the platform (PR:L) and to interact with the crafted link (UI:R). The CVSS vector reflects a scope change (S:C), meaning the vulnerable component can affect resources beyond its security authority — consistent with arbitrary JavaScript executing in the user's authenticated session context. Confidentiality and Integrity impacts are both rated Low (C:L/I:L) because the XSS executes with the privileges of the targeted user rather than yielding direct server compromise; Availability impact is None (A:N).

Notable technical constraints from the data provided:

• The exact product version range is not published in the available intelligence (affected versions list is empty), so operators must determine exposure by product identity and deployed build rather than by a known vulnerable version window.
• No public PoC, exploit code, or Nuclei template is known. The mechanism above is derived strictly from the NVD description; no specific function, class, or parameter names beyond next and location.href are documented, and none are asserted here.

Exploitation Scenarios

The attack chain below is described at the vulnerability-class level, since no public PoC or code-level detail is available. No function names, endpoints, or parameters are asserted beyond those explicitly appearing in the NVD description (next query parameter, location.href, and the javascript:/data: scheme classes).

1. Reconnaissance / target identification. The attacker identifies internet- or intranet-reachable Ansible Platform UI deployments. Because the flaw is unpatched and no version range is published, any deployment exposing the UI is a candidate until the operator confirms otherwise. The attacker confirms the redirect route and its next parameter behavior on a benign target (e.g., with a harmless on-site value) to observe how the parameter is honored.

2. Triggering the flaw class. The attacker crafts a URL pointing at the Ansible Platform UI redirect route with the next query parameter populated by a script-capable URI scheme — precisely the class of value the platform's built-in validators are designed to reject (javascript:, data:). Because the route assigns the parameter directly to location.href without running the validation functions, the scheme reaches the navigation sink intact.

3. Payload / execution method. The crafted link is delivered to an authenticated Ansible Platform user via phishing, chat, ticket, or any channel where a platform URL is credible. When the victim authenticates (if not already) and clicks the link, the browser loads the UI route, reads next, and assigns it to location.href. The browser processes the script-capable scheme and executes the attacker's JavaScript in the origin of the Ansible Platform UI, within the victim's authenticated session context.

4. Post-exploitation impact. With script execution in the platform origin, the attacker can operate with the victim user's session privileges: reading page content and any data the UI exposes to that user, issuing authenticated requests to platform endpoints on the user's behalf (state-changing actions within the user's authorization), exfiltrating tokens or data accessible from the DOM, and altering the rendered UI to facilitate further social engineering. Because scope is changed (S:C) but confidentiality and integrity impacts are rated Low and availability None, the realistic ceiling of a single victim is session-limited abuse rather than direct platform compromise — though a high-privilege victim (e.g., an automation administrator) materially raises the blast radius.

Note: No public PoC is available; this attack chain is inferred from the vulnerability class (DOM-based XSS via unvalidated redirect parameter). It does not assert specific code patterns or implementation details beyond those in the source description.

Impact Assessment

CVE-2026-106033 carries a CVSS 3.1 base score of 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Reading the subscores:

• AV:N (Network) — the redirect route is reachable over the network; no local access is needed to deliver the malicious link.
• AC:L (Low) — no special conditions or race windows are required; a single crafted parameter value suffices.
• PR:L (Low) — the attacker must target a user who holds an authenticated account on the platform; the attacker themselves need not possess privileged credentials to craft the link.
• UI:R (Required) — the victim must click the crafted link; this is the primary friction in the chain and the reason the score is not higher.
• S:C (Changed) — the executed script affects resources beyond the vulnerable component's security scope, i.e., the authenticated session context of the Ansible Platform UI.
• C:L / I:L — limited confidentiality and integrity impact, bounded by the victim user's permissions.
• A:N — no availability impact.

Business impact. Ansible Platform UI is an operational control plane for automation. A successful DOM-based XSS against an authenticated user yields the attacker the ability to act as that user inside the platform UI: viewing data exposed to that account and submitting authenticated requests through the user's browser. Where the victim is an automation or platform administrator, the effective reach is substantially larger than the base score alone suggests, since administrator-level session abuse can translate into broad configuration and job-management influence. Primary affected systems are Ansible Platform UI deployments exposed to their user base (including any that are internet-facing, which sharply increases link-delivery credibility and attacker reach).

Blast radius. Per-victim and session-scoped, with the total blast radius scaling with (a) how many users can be induced to click, and (b) the privilege level of those users. There is no evidence of worm-like propagation, server-side takeover, or unauthenticated exploitation. CISA KEV status is NO, and there is no exploit-in-the-wild evidence in the provided data, which currently lowers the operational urgency — but the absence of a patch (patch confidence 0/4) means exposure persists until mitigations are applied.

Detection Guidance

Sigma Rule

title: Potential DOM-Based XSS via Ansible Platform UI Redirect 'next' Parameter (CVE-2026-106033)
id: 7c3f1a92-4d6e-4b21-9f88-ansible106033
status: experimental
description: Detects HTTP requests to the Ansible Platform UI carrying a script-capable
  URI scheme in the 'next' query parameter, consistent with DOM-based XSS exploitation
  attempts against the redirect route. Detection is best-effort; the payload may be
  encoded, so multiple encoding variants are matched.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106033
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_route:
    cs-uri-query|contains: 'next='
  selection_scheme:
    cs-uri-query|contains:
      - 'next=javascript:'
      - 'next=data:'
      - 'next=%6a%61%76%61%73%63%72%69%70%74%3a'
      - 'next=JaVaScRiPt:'
      - 'next=%64%61%74%61%3a'
  selection_obfuscation:
    cs-uri-query|contains:
      - 'javascript%3a'
      - 'data%3a'
      - 'jav	ascript'
      - 'java%0ascript'
  condition: selection_route and (selection_scheme or selection_obfuscation)
falsepositives:
  - Legitimate application flows passing a relative path that coincidentally contains matched strings
  - Security scanners generating benign probes
level: medium
tags:
  - attack.t1059.007
  - cwe.79
  - cve.2026-106033

YARA Rule

rule CVE_2026_106033_DOM_XSS_Redirect_Next_Param
{
    meta:
        description = "Detects artifacts referencing the Ansible Platform UI DOM-based XSS via the 'next' redirect parameter (CVE-2026-106033)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106033"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $param  = "next=" ascii nocase
        $sink   = "location.href" ascii nocase
        $scheme1 = "javascript:" ascii nocase
        $scheme2 = "data:" ascii nocase
        $cve    = "CVE-2026-106033" ascii

    condition:
        uint32(0) != 0x89504E47 and
        (
            ($param and ($scheme1 or $scheme2)) or
            ($sink and ($scheme1 or $scheme2)) or
            $cve
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106033 Possible DOM-Based XSS via Ansible Platform UI Redirect next Parameter"; flow:established,to_server; http.uri; content:"next="; nocase; http.uri; content:"javascript:"; nocase; distance:0; sid:2026106033; rev:1; reference:cve,2026-106033; classtype:web-application-attack; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

alert http any any -> any any (msg:"CVE-2026-106033 Possible DOM-Based XSS via Ansible Platform UI Redirect next Parameter (data scheme)"; flow:established,to_server; http.uri; content:"next="; nocase; http.uri; content:"data:"; nocase; distance:0; sid:2026106034; rev:1; reference:cve,2026-106033; classtype:web-application-attack; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name, source.ip with maxspan=30s
  [network where network.protocol == "http" and
     url.query contains "next=" and
     (url.query contains "javascript:" or url.query contains "data:" or
      url.query contains "javascript%3a" or url.query contains "data%3a")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access OR sourcetype=apache:access
| eval uri_lower = lower(uri)
| eval scheme_hit = if((match(uri_lower, "next=.*(javascript|data):")
     OR match(uri_lower, "next=.*(%6a%61%76%61%73%63%72%69%70%74|%64%61%74%61)")), 1, 0)
| where scheme_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen
        values(clientip) as source_ips values(status) as status_codes
        by uri, host
| sort - count
| table first_seen, last_seen, host, uri, source_ips, status_codes, count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-106033,">
  <rule id="1060331" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>next=</match>
    <regex type="pcre2">(?i)next=(?:[^&]*?)(?:javascript|data)(?:%3a|:)</regex>
    <description>CVE-2026-106033: Possible DOM-based XSS attempt - script-capable scheme in 'next' redirect parameter</description>
    <group>cve-2026-106033,dom_xss,</group>
  </rule>

  <rule id="1060332" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>next=</match>
    <regex type="pcre2">(?i)next=(?:[^&]*?)(?:%6a%61%76%61%73%63%72%69%70%74|%64%61%74%61)</regex>
    <description>CVE-2026-106033: Possible DOM-based XSS attempt - URL-encoded script-capable scheme in 'next' redirect parameter</description>
    <group>cve-2026-106033,dom_xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, no vendor fix is available, and no workaround is documented. Treat this as an open exposure requiring compensating controls.

1) Immediate mitigations (apply now, no vendor patch required):

• Apply the platform's existing URL validation functions to the vulnerable redirect route before any assignment to location.href. Because the platform already contains validators that block javascript:/data: schemes and off-site or protocol-relative redirects, the fastest defensive fix is to route the next parameter through those same validators (or an equivalent strict allowlist) so the bypass route is closed.
• Adopt a strict allowlist for next: accept only server-relative paths on the platform's own origin; reject any value containing a scheme, a leading // (protocol-relative), or control/whitespace characters used to obfuscate scheme names.
• Where the platform allows it, configure Content-Security-Policy on the UI with script-src that excludes unsafe-inline and blocks javascript:/data: execution contexts, and set base-uri 'self'; CSP is a compensating control, not a substitute for input validation.
• Restrict network exposure of the Ansible Platform UI to trusted networks or VPN; avoid direct internet exposure, which is what makes crafted-link delivery credible at scale.
• Enforce least privilege on platform accounts so that a compromised session carries the minimum blast radius possible.
• Deploy the Sigma/Suricata/Wazuh detections above and hunt for historical hits against the next parameter.

2) Patch / upgrade steps:

• No patch is available. Monitor the vendor's advisories and this CVE record continuously; when a fixed release is published, upgrade the Ansible Platform UI to that version promptly.
• Because no affected version range is published, maintain an inventory of all Ansible Platform UI deployments and their exact builds so that patch applicability can be assessed immediately upon release.
• Until then, version-based patch verification is not possible; verify mitigation by testing the redirect route with benign and scheme-bearing next values to confirm validation now rejects them.

3) Long-term hardening:

• Eliminate the class of defect: centralize all redirect and navigation handling through a single reviewed helper that enforces scheme and origin validation by default, so future routes cannot silently bypass the controls.
• Add static analysis / SAST rules that flag direct assignments of request-derived values to DOM navigation sinks (location.href and equivalents).
• Integrate CSP with nonce- or hash-based script allowlisting to harden the UI against DOM XSS variants generally.
• Institute phishing-resistant MFA and session hygiene for platform administrators to reduce the impact of session-context abuse.
• Maintain continuous vulnerability monitoring (NVD, OSV, vendor advisories) for this CVE ID and alert on a patch becoming available, given patch confidence is currently 0/4.

References

• NVD — CVE-2026-106033: https://nvd.nist.gov/vuln/detail/CVE-2026-106033
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• Red Hat Product Security / Ansible Automation Platform security advisories: https://access.redhat.com/security/
• FIRST EPSS (CVE not yet scored at time of writing — verify current status): https://api.first.org/data/v1/epss?cve=CVE-2026-106033
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-106033 NOT listed — no KEV evidence): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-106033 in the available intelligence. No public PoC, exploit code, or Nuclei template is known.