CVE-2026-44188: Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-15 · updated 2026-08-20
Weakness: CWE-613

Description

A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access to the Ansible Lightspeed instance. If an attacker exfiltrates a valid OAuth (Open Authorization) access token before a user logs out, they can continue to authenticate and access sensitive data. This is because the application fails to invalidate the token on the backend, leaving it valid until its natural expiration. This can lead to unauthorized read access to Ansible resources such as inventories, playbooks, and configuration data.

Affected products

Red Hat Ansible Automation Platform 2: all versions
Red Hat Ansible Automation Platform 2.6: all versions — fixed in 1782755166
Red Hat Ansible Automation Platform 2.7: all versions — fixed in 1781025813

How to fix

Upgrade to a fixed version: Red Hat Ansible Automation Platform 2.6 1782755166; Red Hat Ansible Automation Platform 2.7 1781025813. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-44188 or the next vulnerability affects your stack