CVE-2026-44188: Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration
A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access to the Ansible Lightspeed instance. If an attacker exfiltrates a valid OAuth (Open Authorization) access token before a user logs out, they can continue to authenticate and access sensitive data. This is because the application fails to invalidate the token on the backend, leaving it valid until its natural expiration. This can lead to unauthorized read access to Ansible resources such as inventories, playbooks, and configuration data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the Ansible Lightspeed backend to revoke/invalidate OAuth access tokens when a user logs out so tokens cannot be reused after logout.
Ansible Lightspeed (authentication backend) invalidate_oauth_tokens_on_logout = true - Configuration
Enforce server-side session/token expiration and reduce OAuth access token lifetime so tokens expire sooner and cannot provide persistent access.
Ansible Lightspeed (OAuth/token policy) access_token_lifetime = enforce server-side expiration / shorten lifetime - Compensating control
Restrict access to the Ansible Lightspeed instance to trusted IPs/networks (firewall or ACL) and require multi-factor authentication for user access to reduce the impact of any leaked tokens until fixes are applied.
- Operational
Revoke existing OAuth access tokens that were issued prior to applying the fixes and require affected users to re-authenticate to obtain new tokens.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44188?
CVE-2026-44188 has a medium severity rating of 5.3.
How do I fix CVE-2026-44188?
To fix CVE-2026-44188, ensure proper session expiration settings are implemented in Ansible Lightspeed.
What impact does CVE-2026-44188 have on Ansible Lightspeed?
CVE-2026-44188 allows remote attackers to perform session hijacking and gain unauthorized access to data.
Is CVE-2026-44188 related to OAuth tokens?
Yes, CVE-2026-44188 involves the potential exfiltration of valid OAuth access tokens.
What systems are affected by CVE-2026-44188?
CVE-2026-44188 impacts instances running Ansible Lightspeed which do not properly manage session expiration.