Is CVE-2026-84683 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84683 being exploited in the wild.

How severe is CVE-2026-84683?

High severity, with a CVSS score of 8.7, published 23 September 2026.

Is there a fix for CVE-2026-84683?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84683 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84683?

Check whether you run Red Hat Ansible Automation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84683: Red Hat Ansible Automation Platform controller XSS via ANSI escape sequences

CVE-2026-84683 · Severity: high · CVSS 8.7 · Published 2026-09-23

Red Hat's Ansible Automation Platform includes a web-based controller that displays job output and logs to authorized users. The platform fails to strip ANSI terminal escape sequences before rendering output as HTML, allowing an attacker to inject malicious JavaScript links disguised as hyperlinks. When a higher-privileged administrator views crafted output, clicking the link executes attacker code in their authenticated session, potentially leading to full platform compromise.

Technologies: Red Hat Ansible Automation Platform. Vendors: Red Hat.

Quick answers

Is CVE-2026-84683 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84683 being exploited in the wild.
How severe is CVE-2026-84683?: High severity, with a CVSS score of 8.7, published 23 September 2026.
Which products and versions are affected?: Red Hat Ansible Automation Platform <UNKNOWN>.
Is there a fix for CVE-2026-84683?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84683 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84683?: Check whether you run Red Hat Ansible Automation Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored/reflected XSS flaw in the automation-controller's HTML rendering of job, ad hoc command, project update, and inventory update output. While the controller escapes HTML metacharacters, it does not strip ANSI OSC 8 hyperlink escape sequences; these are converted to HTML anchor tags with unfiltered, unescaped href attributes, allowing javascript: scheme links. The attack requires that a low-privileged user or external data source can produce output echoed by a playbook, and requires user interaction (clicking the link) in a higher-privileged user's session with no Content-Security-Policy restriction.

Affected products

Red Hat Ansible Automation Platform <UNKNOWN>

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.