CVE-2024-10033
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A Cross-site Scripting (XSS) vulnerability exists in the aap-gateway component. A malicious user can exploit the "?next=" parameter in a URL to perform redirects, inject malicious scripts, and steal sessions and data.
Risk Assessment
An attacker could hijack user sessions, perform actions on their behalf, and exfiltrate sensitive data, potentially compromising the entire system.
Recommendation
Update aap-gateway to a patched version; implement URL parameter validation and sanitization, and consider enabling security headers (CSP).
Other vulnerabilities in aap-gateway
See all- CVE-2026-18141High
In the aap-gateway component of Ansible Automation Platform's Event-Driven Ansible (EDA), a vulnerability allows an unauthenticated remote attacker to bypass mTLS authentication for event streams. The attacker can manipulate the event stream URL and forge the HTTP Subject header, while the system inadvertently discloses the expected certificate subject in error messages.
- CVE-2026-6266High
A flaw was found in the AAP gateway where the user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.
Original NVD description (English source)
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS