CVE-2026-44187
LowCVSS 3.3Summary
The Ansible Lightspeed extension for Visual Studio Code stores the Google Gemini API key in plain text in the user's configuration file and writes it to log files. A local attacker or malware with user privileges can read this key.
Risk Assessment
Disclosure of the API key could allow an attacker to consume the victim's API quota, leading to unauthorized usage and potential costs.
Recommendation
Update the Ansible Lightspeed extension to a version that securely stores the API key. Until then, avoid using the extension on shared or untrusted workstations.
Other vulnerabilities in Ansible Lightspeed
See all- CVE-2026-44190High
The Ansible Lightspeed extension for Visual Studio Code contains a command injection vulnerability (CWE-78). The `ansible.python.activationScript` setting does not properly validate the file path, allowing a remote attacker to execute unauthorized commands on the user's system when a crafted project is opened.
- CVE-2026-44188Medium
A flaw was found in Ansible Lightspeed related to insufficient session expiration. A remote attacker can maintain persistent access to the Ansible Lightspeed instance if they exfiltrate a valid OAuth access token before a user logs out. The application fails to invalidate the token on the backend, leaving it valid until its natural expiration.
Original NVD description (English source)
A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text within the user's configuration file and writes it to output log files. This information disclosure can lead to the attacker obtaining the API credential and potentially consuming the user's API quota.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS