PT-2026-6676 · Unknown · Ansible Lightspeed

Laura Pardo · Published 2026-02-06 · Updated 2026-05-04 · CVE-2026-0598

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ansible Lightspeed (affected versions not specified)

Description The Ansible Lightspeed API conversation endpoints, which manage AI chat interactions, do not adequately confirm if a conversation identifier corresponds to the authenticated user. This allows an attacker with valid credentials to access or modify conversations belonging to other users, potentially exposing sensitive data and enabling unauthorized manipulation of AI-generated outputs. The affected API endpoints are conversation endpoints. The vulnerable parameter is the conversation identifier.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-283

Related Identifiers

CVE-2026-0598

Affected Products

Ansible Lightspeed

References · 8

• https://access.redhat.com/errata/RHSA-2026:13545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0598 · Security Note
• https://twitter.com/CVEnew/status/2019654608050626909 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2019713129370865963 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2427094 · Note
• https://t.me/cveNotify/151088 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2026-0598 · Note
• https://t.me/cveNotify/162092 · Telegram Post