CVE-2026-44188 Details

A vulnerability in Red Hat Ansible Lightspeed has been identified, stemming from inadequate session expiration. This flaw enables a remote attacker to retain persistent access to an Ansible Lightspeed instance. If an attacker obtains a valid OAuth access token before a user logs out, they can continue to authenticate and access sensitive information. The application does not invalidate the token on the backend, allowing it to remain active until its natural expiration. Consequently, this vulnerability could result in unauthorized read access to Ansible resources, including inventories, playbooks, and configuration data.

Users can upgrade to Red Hat Ansible Automation Platform 2.7 to address this vulnerability. For instructions on how to apply this update, refer to the Red Hat Ansible Automation Platform 2.7 Upgrade Guide.