REDHAT-BUG-2466764: Medium severity Ansible Ansible Lightspeed vulnerability
A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access to the Ansible Lightspeed instance. If an attacker exfiltrates a valid OAuth (Open Authorization) access token before a user logs out, they can continue to authenticate and access sensitive data. This is because the application fails to invalidate the token on the backend, leaving it valid until its natural expiration. This can lead to unauthorized read access to Ansible resources such as inventories, playbooks, and configuration data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement server-side invalidation/revocation of OAuth access tokens when a user logs out so tokens cannot be used after logout.
Ansible Lightspeed invalidate_oauth_access_tokens_on_logout = true - Configuration
Configure the application to enforce shorter OAuth access-token lifetimes and stricter session expiration to limit the window in which an exfiltrated token remains valid.
Ansible Lightspeed oauth_access_token_lifetime = reduced - Operational
Revoke or rotate existing OAuth access tokens and require users to re-authenticate so any previously exfiltrated tokens are invalidated.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2466764?
The severity of REDHAT-BUG-2466764 is classified as medium with a CVSS score of 4.
How do I fix REDHAT-BUG-2466764?
To fix REDHAT-BUG-2466764, ensure that session expiration is properly configured and implement access token expiration policies.
What could be the impact of exploiting REDHAT-BUG-2466764?
Exploiting REDHAT-BUG-2466764 could allow a remote attacker to maintain persistent access to an Ansible Lightspeed instance.
What software is affected by REDHAT-BUG-2466764?
The software affected by REDHAT-BUG-2466764 is Ansible Lightspeed.
When was REDHAT-BUG-2466764 published?
REDHAT-BUG-2466764 was published on May 5, 2026.