CVE-2026-84683

Executive Summary

CVE-2026-84683 is a cross-site scripting vulnerability (CWE-79) in Red Hat Ansible Automation Platform's automation-controller component. The HTML rendering path for standard output of jobs, ad hoc commands, project updates, and inventory updates escapes HTML metacharacters but fails to strip ANSI terminal escape sequences before converting the output to HTML. ANSI OSC 8 hyperlink sequences surviving into the rendered page are expanded into HTML anchors whose href attribute is neither scheme-filtered nor escaped, allowing a low-privileged user — or any external party whose data a playbook echoes — to embed a javascript: link into a text/html response served without a Content-Security-Policy. When a higher-privileged user views and clicks the link, attacker-controlled JavaScript executes within that user's authenticated session, enabling actions as that user up to full platform takeover. The vulnerability is network exploitable, requires low privileges, requires user interaction, and has scope change with high confidentiality and integrity impact, yielding a CVSS 3.1 base score of 8.7.

Technical Analysis

The vulnerability resides in the ANSI-to-HTML conversion logic used by the automation-controller when rendering the standard output of automation activity. The affected surfaces, as described by the vendor, are the HTML views for:

• job output,
• ad hoc command output,
• project update output, and
• inventory update output.

The rendering pipeline performs two distinct operations that are mishandled in sequence:

1. HTML metacharacter escaping — angle brackets, ampersands and related characters are escaped so that raw output text cannot break out of the HTML document structure directly. This control operates as intended.
2. ANSI escape sequence conversion — terminal control sequences in the output are translated into HTML markup (for example, styling and hyperlinks) so that colored or interactive terminal output displays correctly in the web UI. This is the point of failure.

The flaw is that the conversion step does not remove or neutralize ANSI escape sequences before HTML generation. Specifically, the ANSI OSC 8 hyperlink sequence (a terminal hyperlink escape used to render clickable links in terminals) is expanded into an HTML anchor element. Critically:

• The href attribute of that generated anchor is not scheme-filtered — a scheme such as javascript: is not rejected.
• The href attribute is not escaped — the value is written into the attribute without encoding.

Because metacharacter escaping applies to the raw text but the ANSI converter subsequently introduces markup, the escaping control does not protect the newly generated attribute. The result is a stored/rendered cross-site scripting condition: attacker-influenced output becomes executable markup in a text/html response.

Two further factors amplify the issue. First, any low-privileged user who can cause output to be produced can plant the malicious escape sequence; additionally, an external party whose data a playbook echoes into output can inject it indirectly — meaning the attacker need not even hold an account on the platform. Second, the affected text/html response is served with no Content-Security-Policy header, so there is no defense-in-depth restriction (e.g., script-src) to block or neutralize the javascript: navigation when the link is activated.

The triggering action is user interaction: a higher-privileged user must click the rendered link. On click, the javascript: URI executes in the origin of the automation-controller, in the victim's authenticated session context.

The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N reflects: remote reachability (network), low attack complexity, low privileges required, mandatory user interaction, scope change (execution escapes the intended output-rendering context into the victim's authenticated session and can affect resources beyond the vulnerable component), and high confidentiality and integrity impact with no direct availability impact.

No public proof-of-concept, exploit code, or Nuclei template is known. The defect class is well understood (HTML injection via an unsanitized attribute in a markup-conversion path), but no implementation-specific details beyond those in the vendor description should be assumed.

Exploitation Scenarios

The following chain is inferred from the vulnerability class (CWE-79 via unsanitized ANSI-to-HTML conversion) and the vendor description. No public PoC exists; specific code paths are not asserted.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-reachable Ansible Automation Platform deployment running the affected automation-controller. The attacker determines whether they can (a) hold a low-privileged account able to trigger jobs, ad hoc commands, project updates, or inventory updates, or (b) influence data that a target playbook echoes into standard output.

2. Triggering the flaw class. The attacker causes output containing an ANSI OSC 8 hyperlink escape sequence to be produced and stored as the standard output of a job, ad hoc command, project update, or inventory update. Two injection routes are available per the description: direct production by a low-privileged user, or indirect injection through external data that a playbook echoes. The escape sequence encodes a hyperlink target using the javascript: scheme.

3. Payload execution (vulnerability-class level). When the HTML view of the affected output is rendered, the ANSI converter expands the OSC 8 sequence into an HTML anchor element. Because the href value is neither scheme-filtered nor escaped, the anchor points at the javascript: URI. The page is served as text/html with no Content-Security-Policy. A higher-privileged user viewing the page clicks the link; the attacker-supplied JavaScript then executes in that user's authenticated browser session for the automation-controller origin.

4. Post-exploitation impact. Executing in the privileged user's session, the JavaScript can perform any action that user is authorized to perform against the platform. Per the vendor, this ranges up to full platform takeover — i.e., the attacker can leverage the victim's session and privileges to act as that user, potentially modifying or executing automation, altering credentials or inventories, and pivoting to managed infrastructure that the platform controls. Confidentiality and integrity impacts are rated High; the scope change in the CVSS vector captures the escape from the output-rendering context into the broader authenticated platform session.

Impact Assessment

Successful exploitation yields authenticated-session JavaScript execution in the context of a higher-privileged automation-controller user, with scope change and high confidentiality and integrity impact (C:H/I:H), and no direct availability impact (A:N). Red Hat describes the worst case as full platform takeover.

Business impact is significant because Ansible Automation Platform is frequently the orchestration hub with credentials and connectivity to large estates of managed hosts, cloud accounts, and network devices. A compromised privileged session can translate into control over the automation layer and, through it, the systems automation manages — a high-value lateral movement and persistence position.

Blast radius considerations:

• Direct injection requires only low privileges (PR:L) and the ability to produce output on the four affected views.
• Indirect injection requires no platform account at all: any external party whose data is echoed by a playbook into standard output can plant the payload, broadening the pool of potential attackers.
• Delivery requires user interaction (UI:R): a privileged user must view and click the crafted link — a realistic precondition given that reviewing job and project-update output is routine operator behavior.
• Reachability is network-based (AV:N) with low attack complexity (AC:L).
• No exploit code, no public PoC, and no CISA KEV listing indicate the issue is not currently known to be exploited in the wild; however, absence of observed exploitation does not reduce the severity of the underlying flaw.

Detection Guidance

Sigma Rule

title: Ansible Automation Controller ANSI OSC 8 javascript: Hyperlink Injection
id: 9c2f1a44-7b6e-4d3a-9f21-ansible84683
status: experimental
description: Detects ANSI OSC 8 hyperlink escape sequences carrying a javascript: scheme in Ansible automation-controller output, consistent with CVE-2026-84683 HTML injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84683
author: valtersit.com
date: 2026/01/01
logsource:
  product: ansible
  service: automation-controller
detection:
  selection_osc8:
    output|contains|all:
      - '\x1b]8;'
      - 'javascript:'
  selection_views:
    view|contains:
      - 'job'
      - 'adhoc'
      - 'project_update'
      - 'inventory_update'
  condition: selection_osc8
falsepositives:
  - Legitimate hyperlinks in output using non-javascript schemes (filtered by scheme match)
  - Terminal tooling that emits OSC 8 sequences with benign targets
level: high
tags:
  - attack.t1059.007
  - cwe.79

YARA Rule

rule CVE_2026_84683_Ansible_OSC8_JavaScript_Hyperlink
{
    meta:
        description = "Detects ANSI OSC 8 hyperlink sequences embedding javascript: scheme, associated with CVE-2026-84683 in Red Hat Ansible automation-controller"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84683"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $osc8 = { 1B 5D 38 3B }              // ESC ] 8 ;
        $js   = "javascript:" ascii nocase
        $cterm = { 1B 5C }                   // ST terminator (ESC \)

    condition:
        $osc8 and $js
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84683 Ansible Automation Controller OSC 8 javascript: Hyperlink Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v2/"; http.request_body; content:"javascript:"; http.request_body; content:"|1B 5D 38 3B|"; reference:cve,CVE-2026-84683; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84683; classtype:web-application-attack; sid:8468301; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [any where event.category == "web"
     and http.request.method == "POST"
     and http.request.body.text contains "javascript:"
     and http.request.body.text contains "\\x1b]8;"]
  [any where event.category == "web"
     and http.response.status_code == 200
     and http.response.mime_type == "text/html"]

Splunk SPL Query

index=web sourcetype=ansible:automation_controller
| search (uri_path="/api/v2/*" OR uri_path="/*/output*")
| eval body_lower=lower(request_body)
| where (like(body_lower, "%javascript:%") AND (like(body_lower, "%\\x1b]8;%") OR like(body_lower, "%\\\\u001b]8;%")))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip user uri_path
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,ansible,cve-2026-84683,">
  <rule id="846830" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.request.body">javascript:</field>
    <field name="http.request.body">\x1b]8;</field>
    <description>CVE-2026-84683: ANSI OSC 8 javascript: hyperlink injection into Ansible automation-controller output</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_84683,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source; no vendor fix or affected-version range has been published in the data available. Treat all deployments of the affected automation-controller component as vulnerable until Red Hat publishes a fixed release.

1. Immediate mitigations

   • Deploy a Content-Security-Policy response header on the automation-controller web origin as defense-in-depth, e.g. Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'none'. A restrictive script-src that excludes unsafe-inline and blocks javascript: navigation mitigates the click-to-execute path even while the underlying rendering defect remains. Note the vendor description states the affected response currently ships with no CSP, which is why this is the highest-value compensating control.
   • Restrict who can author or trigger playbooks whose output is rendered to privileged viewers, and review any playbook that echoes untrusted external data into standard output.
   • Reduce the population of low-privileged accounts able to generate job, ad hoc command, project update, or inventory update output, and audit such accounts.
   • Limit exposure of the automation-controller web interface to trusted networks/VPN; do not expose it directly to the internet where avoidable.

2. Patch / upgrade steps

   • Monitor the Red Hat Ansible Automation Platform security advisories (Red Hat CVE page / RHSA channel) for the CVE-2026-84683 fix. No fixed version is identified in currently available data.
   • Once a fixed automation-controller release is published, upgrade promptly and verify the CVE against the release notes. Validate that the ANSI-to-HTML conversion now strips OSC 8 sequences and/or scheme-filters and escapes the generated href.
   • Where the platform is containerized/Operator-managed, apply the corresponding updated automation-controller image once released.

3. Long-term hardening

   • Enforce a default-src-restricted CSP across all automation-controller web responses, not only output views.
   • Institute output-sanitization testing: fuzz the ANSI-to-HTML converter with OSC 8, OSC 8 with javascript:, data:, and other dangerous schemes, confirming both scheme filtering and attribute escaping.
   • Apply least privilege to automation-controller accounts and segregate roles capable of producing output from those with elevated platform privileges.
   • Add detection coverage (rules above) for OSC 8 / javascript: sequences in submitted output and HTTP request bodies as a monitoring backstop.
   • Track CISA KEV for any future addition; none is currently listed.

References

• NVD — CVE-2026-84683: https://nvd.nist.gov/vuln/detail/CVE-2026-84683
• CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
• Red Hat Product Security — security advisories and CVE pages for Ansible Automation Platform: https://access.redhat.com/security/
• FIRST EPSS — CVE-2026-84683: no score published at time of writing
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-84683 not listed)

No public proof-of-concept, exploit code, or Nuclei template is available, and no threat-actor campaign or in-the-wild exploitation has been reported. Exploitation mechanics described are inferred from the CWE-79 vulnerability class and the vendor's description of the ANSI OSC 8 conversion flaw.