CVE-2026-44188

Vulnerability

The vulnerability exists in Ansible Lightspeed due to insufficient session expiration. When a user logs out, the application does not invalidate the OAuth access token on the backend, leaving it valid until its natural expiration. This affects the authentication mechanism of Ansible Lightspeed. [2][3]

Exploitation

An attacker who exfiltrates a valid OAuth access token before the user logs out can continue to authenticate to the Ansible Lightspeed instance without reauthorization. The attacker does not need special privileges beyond having the token. The token remains valid until its natural expiration time. [3]

Impact

Successful exploitation allows unauthorized read access to Ansible resources, including inventories, playbooks, and configuration data. This leads to information disclosure of sensitive automation content. [2][3]

Mitigation

Red Hat has released an erratum (RHSA-2026:25928) to fix this issue. Users should update Ansible Lightspeed to the patched version as specified in the advisory. If immediate patching is not possible, ensure OAuth tokens are rotated and logs are monitored for unauthorized access. [1]