Executive brief
Ansible Lightspeed, an AI-driven automation tool, contains a flaw where user sessions are not properly terminated upon logout. If an attacker manages to steal a user's login token, they can continue to access the system even after the legitimate user has logged out. This could allow unauthorized individuals to view sensitive automation data, including playbooks, inventories, and system configurations.
Technical details
A vulnerability classified as Insufficient Session Expiration (CWE-613) exists in Ansible Lightspeed. The root cause is the application's failure to invalidate OAuth access tokens on the backend when a user performs a logout action. An attacker who obtains a valid token (e.g., through interception or local exfiltration) can continue to authenticate against the API until the token's natural expiration time is reached. This provides unauthorized read access to sensitive Ansible resources, including inventories and playbooks. The attack requires the attacker to have already obtained a valid token, resulting in a High Attack Complexity rating. Red Hat has released updates for Ansible Automation Platform 2.7 to address this issue.
Affected products
- Red Hat Ansible Automation Platform 2.7
- Red Hat Ansible Lightspeed
Timeline
- 2026-05-05: other: Initial report in Red Hat Bugzilla
- 2026-06-15: advisory: NVD and Red Hat security advisory published
- 2026-06-15: patched: Red Hat released RHSA-2026:25928 fixing the issue in AAP 2.7