Vulnerability · Published Jul 22, 2026 · Assigned by redhat

CVE-2026-44191Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settings

High 7.8

In plain English

A high-severity OS command injection in Red Hat Ansible Automation Platform 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.8%top 42.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell separators. This can be triggered automatically during Language Server initialization or manually when executing a playbook. Successful exploitation leads to remote code execution (RCE) on the victim's machine with the privileges of the Visual Studio Code user, potentially resulting in a complete system compromise.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Ansible Automation Platform 2	see references
Red Hat	Red Hat Ansible Automation Platform 2	see references
Red Hat	Red Hat Ansible Automation Platform 2	see references

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-44191 vdb-entry, x_refsource_REDHAT
RHBZ#2466761 issue-tracking, x_refsource_REDHAT