Ansible: Five Vulnerabilities Disclosed Together Affecting VS Code Extension, AWX, and Community Content
Key findings • Five Ansible-related vulnerabilities disclosed on July 22, 2026, affecting VS Code extension, AWX, and community.general. • Two 'important' severity vulnerabilities in Ansible …
Key findings
- Five Ansible-related vulnerabilities disclosed on July 22, 2026, affecting VS Code extension, AWX, and community.general.
- Two 'important' severity vulnerabilities in Ansible Lightspeed VS Code extension allow arbitrary code execution.
- AWX vulnerability CVE-2026-16544 permits cross-organization stdout disclosure via missing websocket authorization.
- community.general's jenkins_credential module leaks API tokens in plaintext.
- Vulnerabilities range from arbitrary code execution and information disclosure to sensitive token exposure.
On July 22, 2026, a batch of five vulnerabilities affecting Ansible products was disclosed, spanning the Ansible Lightspeed VS Code extension, AWX, and the community.general collection. The disclosures, all occurring within a 12-hour window, highlight potential risks including arbitrary code execution, information disclosure, and plaintext API token leakage.
The Ansible Lightspeed extension for Visual Studio Code is impacted by three of these vulnerabilities. CVE-2026-44190 and CVE-2026-44189, both rated as 'important' with a CVSSv3 score of 7.8, allow for arbitrary code execution. CVE-2026-44190 stems from command injection in the activation script setting, while CVE-2026-44189 is due to a malicious playbook filename. A separate, lower-severity vulnerability (CVSSv3 3.3), CVE-2026-44187, involves the information disclosure of Google Gemini API keys.
Beyond the Lightspeed extension, AWX, Red Hat's open-source automation platform, is affected by CVE-2026-16544. This 'moderate' severity vulnerability (CVSSv3 6.5) arises from missing authorization in the websocket EventConsumer, potentially allowing cross-organization disclosure of stdout data for inventory updates, project updates, and system job events.
Additionally, the community.general collection, a set of Ansible content, has a moderate severity vulnerability (CVSSv3 6.1), CVE-2026-16566. The jenkins_credential module within this collection was found to return generated API tokens in plaintext output, posing a risk of sensitive credential exposure.
The coordinated disclosure of these vulnerabilities on July 22, 2026, underscores the importance of timely patching and security reviews for the Ansible ecosystem. Users are advised to review the specific advisories for each CVE to understand the affected versions and apply necessary updates or mitigations to protect against potential exploitation.
This batch of disclosures serves as a reminder for Ansible users to stay vigilant regarding security updates across all components of their automation infrastructure, from development tools like VS Code extensions to core platforms like AWX and community-provided content.