# CVE-2026-106033: Red Hat Ansible Automation Platform DOM-based XSS in redirect parameter

Source: https://junglewise.ai/threats/cve-2026-106033-a-dom-based-cross-site-scripting-xss-vulnerability-exists-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106033 · Severity: medium · CVSS 5.4 · Published 2026-10-06

A cross-site scripting vulnerability exists in the Ansible Automation Platform's web UI that allows attackers to inject and execute arbitrary JavaScript code. An authenticated user tricked into clicking a malicious link can have their session hijacked, allowing the attacker to steal credentials, session tokens, or perform administrative actions on their behalf.

Technologies: [Red Hat Ansible Automation Platform](https://junglewise.ai/threats/technologies/ansible-automation-platform-2). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-106033 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106033 being exploited in the wild.

**How severe is CVE-2026-106033?** Medium severity, with a CVSS score of 5.4, published 6 October 2026.

**Which products and versions are affected?** Red Hat Ansible Automation Platform.

**Is there a fix for CVE-2026-106033?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-106033 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-106033?** Check whether you run Red Hat Ansible Automation Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A DOM-based XSS vulnerability in the redirect route allows attackers to bypass the platform's built-in URL validation controls. The application extracts an unsanitized destination from the 'next' query parameter and directly assigns it to location.href without validating the URI scheme, enabling injection of javascript: or data: URIs. Exploitation requires the authenticated victim to click a crafted link, resulting in arbitrary JavaScript execution in their session context.

## Affected products

- Red Hat Ansible Automation Platform

## Timeline

- 2026-10-06: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-106033](https://access.redhat.com/security/cve/CVE-2026-106033)

## Related threats

- [AWX WebSocket consumer incorrect authorization](https://junglewise.ai/threats/cve-2026-71367-an-incorrect-authorization-vulnerability-was-found-in-awx-s)
- [Red Hat Ansible Automation Platform cleartext storage of resource-server secret](https://junglewise.ai/threats/cve-2026-126643-a-cleartext-storage-flaw-was-found-in-the-aap-gateway-operator)
- [Pulpcore expression language injection in content guard](https://junglewise.ai/threats/cve-2026-123084-an-expression-language-injection-has-been-found-in-the)
- [Red Hat Ansible Automation Platform stored XSS in Hub documentation renderer](https://junglewise.ai/threats/cve-2026-109131-the-hub-collection-module-documentation-renderer-in-the-unified)
- [Ansible Operator Jinja2 template injection](https://junglewise.ai/threats/cve-2026-92982-a-flaw-was-found-in-ansible-operator-plugins-a-low-privileged)