CVE-2026-84683 Red Hat CVE debrief

Who should care

Defenders and administrators of Red Hat Ansible Automation Platform should assess exposure and prioritize mitigation, especially in environments where low-privileged users can produce output or external parties' data is echoed in playbooks.

Why it matters

CVE-2026-84683 is a high-severity vulnerability in Red Hat Ansible Automation Platform's automation-controller that allows a low-privileged user to potentially execute attacker-controlled JavaScript as a higher-privileged user, leading to full platform takeover. Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where low-privileged users can produce output or external parties' data is echoed in playbooks.

• Potential execution of attacker-controlled JavaScript in a higher-privileged user's authenticated session.
• Possible full platform takeover by an attacker.
• Need for verification of affected versions and remediation status.
• Importance of restricting user privileges and monitoring output.

Technical summary

The HTML view of job, ad hoc command, project update, and inventory update standard output in Red Hat Ansible Automation Platform's automation-controller escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. This allows a low-privileged user to embed a javascript: link that can be executed as a higher-privileged user. The vulnerability arises from the lack of filtering for ANSI OSC 8 hyperlink sequences, which can be expanded into HTML anchors with unfiltered href attributes. Consequently, an attacker can exploit this by embedding malicious links that execute JavaScript in the context of a higher-privileged user's session, potentially leading to full platform

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where low-privileged users can produce output or external parties' data is echoed in playbooks.

Recommended defensive actions

• Verify and apply Red Hat's provided errata and security advisories to mitigate the vulnerability.
• Restrict user privileges and monitor output to prevent exploitation.
• Implement Content Security Policy to restrict JavaScript execution.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.7 and severity of HIGH. Red Hat has provided errata and security advisories related to this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.