Vulnerability · Published Jun 15, 2026 · Assigned by redhat
CVE-2026-44188Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration
Medium 5.3
In plain English
A medium-severity security flaw in Red Hat Ansible Automation Platform 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access to the Ansible Lightspeed instance. If an attacker exfiltrates a valid OAuth (Open Authorization) access token before a user logs out, they can continue to authenticate and access sensitive data. This is because the application fails to invalidate the token on the backend, leaving it valid until its natural expiration. This can lead to unauthorized read access to Ansible resources such as inventories, playbooks, and configuration data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:24.04:LTS | ansible | no fix listed | UBUNTU-CVE-2026-44188 |
| Ubuntu:25.10 | ansible | no fix listed | UBUNTU-CVE-2026-44188 |
| Ubuntu:26.04:LTS | ansible | no fix listed | UBUNTU-CVE-2026-44188 |
| Ubuntu:26.10 | ansible | no fix listed | UBUNTU-CVE-2026-44188 |
| Ubuntu:22.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2026-44188 |
| Ubuntu:24.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2026-44188 |
| Ubuntu:25.10 | ansible-core | no fix listed | UBUNTU-CVE-2026-44188 |
| Ubuntu:26.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2026-44188 |
| Ubuntu:26.10 | ansible-core | no fix listed | UBUNTU-CVE-2026-44188 |
| Ubuntu:22.04:LTS | lightspeed | no fix listed | UBUNTU-CVE-2026-44188 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.6 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2 | see references |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- RHSA-2026:25928 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:34374 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-44188 vdb-entry, x_refsource_REDHAT
- RHBZ#2466764 issue-tracking, x_refsource_REDHAT