REDHAT-BUG-2466764: Medium severity Ansible Ansible Lightspeed vulnerability

Published May 5, 2026
·
Updated

A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access to the Ansible Lightspeed instance. If an attacker exfiltrates a valid OAuth (Open Authorization) access token before a user logs out, they can continue to authenticate and access sensitive data. This is because the application fails to invalidate the token on the backend, leaving it valid until its natural expiration. This can lead to unauthorized read access to Ansible resources such as inventories, playbooks, and configuration data.

Affected Software

1 affected component
Ansible Ansible Lightspeed

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Implement server-side invalidation/revocation of OAuth access tokens when a user logs out so tokens cannot be used after logout.

    Ansible Lightspeed invalidate_oauth_access_tokens_on_logout = true
  2. Configuration

    Configure the application to enforce shorter OAuth access-token lifetimes and stricter session expiration to limit the window in which an exfiltrated token remains valid.

    Ansible Lightspeed oauth_access_token_lifetime = reduced
  3. Operational

    Revoke or rotate existing OAuth access tokens and require users to re-authenticate so any previously exfiltrated tokens are invalidated.

Event History

May 5, 2026
Data Sourced
via Red Hat·03:13 PM
DescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of REDHAT-BUG-2466764?

The severity of REDHAT-BUG-2466764 is classified as medium with a CVSS score of 4.

2

How do I fix REDHAT-BUG-2466764?

To fix REDHAT-BUG-2466764, ensure that session expiration is properly configured and implement access token expiration policies.

3

What could be the impact of exploiting REDHAT-BUG-2466764?

Exploiting REDHAT-BUG-2466764 could allow a remote attacker to maintain persistent access to an Ansible Lightspeed instance.

4

What software is affected by REDHAT-BUG-2466764?

The software affected by REDHAT-BUG-2466764 is Ansible Lightspeed.

5

When was REDHAT-BUG-2466764 published?

REDHAT-BUG-2466764 was published on May 5, 2026.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203