Red Hat Addresses Critical Session Hijacking Vulnerability in Ansible Lightspeed

Red Hat has issued a significant security advisory, RHSA-2026:25928, detailing an important vulnerability affecting Red Hat Ansible Automation Platform 2.7. The core of this issue is identified as CVE-2026-44188, a flaw discovered within Ansible Lightspeed. This particular vulnerability stems from an insufficient session expiration mechanism, creating a window of opportunity for malicious actors. The advisory explains that a remote attacker could exploit this weakness to gain and maintain persistent unauthorized access to an Ansible Lightspeed instance. The attack scenario involves the exfiltration of a valid OAuth (Open Authorization) access token. Crucially, if this token is obtained by an attacker before a legitimate user logs out, the attacker can continue to use it to authenticate and access sensitive information. The underlying problem is that the application fails to invalidate the compromised token on the backend when a user logs out, allowing it to remain active until its predetermined natural expiration. This persistent access poses a significant risk, as it could lead to unauthorized read access to various critical Ansible resources. These resources include, but are not limited to, inventories, which define the hosts managed by Ansible; playbooks, which contain automation instructions; and sensitive configuration data. Such unauthorized access could compromise the integrity and confidentiality of an organization's automated infrastructure. The vulnerability has been categorized with a CVSS score of 5.3 (MEDIUM severity, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating that while it requires some conditions to be met (like a low-privileged attacker and high attack complexity), its impact on confidentiality is high. Red Hat strongly recommends that users of Ansible Automation Platform 2.7 apply the available updates to address this security flaw and protect their automation environments from potential exploitation. The updates are part of the Red Hat Ansible Automation Platform 2.7 Container Release Update.