CVE-2026-44188
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A flaw was found in Ansible Lightspeed related to insufficient session expiration. A remote attacker can maintain persistent access to the Ansible Lightspeed instance if they exfiltrate a valid OAuth access token before a user logs out. The application fails to invalidate the token on the backend, leaving it valid until its natural expiration.
Risk Assessment
An attacker can gain unauthorized access to sensitive Ansible resources such as inventories, playbooks, and configuration data.
Recommendation
Update Ansible Lightspeed to a version that includes a fix enforcing token invalidation upon logout.
Other vulnerabilities in Ansible Lightspeed
See all- CVE-2026-44187Low
The Ansible Lightspeed extension for Visual Studio Code stores the Google Gemini API key in plain text in the user's configuration file and writes it to log files. A local attacker or malware with user privileges can read this key.
- CVE-2026-44190High
The Ansible Lightspeed extension for Visual Studio Code contains a command injection vulnerability (CWE-78). The `ansible.python.activationScript` setting does not properly validate the file path, allowing a remote attacker to execute unauthorized commands on the user's system when a crafted project is opened.
Original NVD description (English source)
A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access to the Ansible Lightspeed instance. If an attacker exfiltrates a valid OAuth (Open Authorization) access token before a user logs out, they can continue to authenticate and access sensitive data. This is because the application fails to invalidate the token on the backend, leaving it valid until its natural expiration. This can lead to unauthorized read access to Ansible resources such as inventories, playbooks, and configuration data.