{"id":"CVE-2026-115730","title":"i18next-http-backend: i18next-http-backend: Cross-site scripting via protocol-relative URL injection (CVE-2026-115730)","summary":"A flaw was found in i18next-http-backend. A remote attacker who can control namespace values can supply input starting with a slash to construct protocol-relative URLs in path templates. This flaw allows translation requests to be redirect…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","cvssSource":"vendor","cwe":["CWE-79","CWE-74"],"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","affected":["migration_toolkit_for_applications 8","multicluster_engine_for_kubernetes","network_observability_operator","openshift_service_mesh 3","advanced_cluster_management_for_kubernetes 2","amq_broker 7","ansible_automation_platform 2","data_grid 8","edge_manager 1","openshift_container_platform 4"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T17:18:17+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115730.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115730.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-115730"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559717"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115730"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115730"},{"url":"https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7"},{"url":"https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5"},{"url":"https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf"},{"url":"https://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-23T13:24:55.508Z","slug":"CVE-2026-115730","body":"## Overview\n\nA flaw was found in i18next-http-backend. A remote attacker who can control namespace values can supply input starting with a slash to construct protocol-relative URLs in path templates. This flaw allows translation requests to be redirected to an attacker-controlled server, leading to cross-site scripting (XSS) and unauthorized user interface content injection.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, Network Observability Operator, OpenShift Service Mesh 3, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AMQ Broker 7, … · no fix planned: OpenShift Service Mesh 3, Red Hat Ansible Automation Platform 2, Red Hat Edge Manager 1, Migration Toolkit for Applications 8, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115730.json)\n\n**i18next-http-backend: i18next-http-backend: Cross-site scripting via protocol-relative URL injection** — rated Low by Red Hat. Released 2026-10-23.\n\nAffected:\n\n- Migration Toolkit for Applications 8\n- Multicluster Engine for Kubernetes\n- Network Observability Operator\n- OpenShift Service Mesh 3\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat Data Grid 8\n- Red Hat Edge Manager 1\n- Red Hat OpenShift Container Platform 4\n\nNo fix planned:\n\n- OpenShift Service Mesh 3\n- Red Hat Ansible Automation Platform 2\n- Red Hat Edge Manager 1\n- Migration Toolkit for Applications 8\n- Multicluster Engine for Kubernetes\n- Network Observability Operator\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat AMQ Broker 7\n- Red Hat Data Grid 8\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nOut of support scope","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}