CVE-2026-0598 PUBLISHED

Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api

Assigner: redhat
Reserved: 05.01.2026 Published: 06.02.2026 Updated: 06.02.2026

A security flaw was identified in the Ansible Lightspeed API conversation endpoints that handle AI chat interactions. The APIs do not properly verify whether a conversation identifier belongs to the authenticated user making the request. As a result, an attacker with valid credentials could access or influence conversations owned by other users. This exposes sensitive conversation data and allows unauthorized manipulation of AI-generated outputs.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 4.2

Product Status

Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Credits

  • Red Hat would like to thank Laura Pardo (RedHat) for reporting this issue.

References

Problem Types

  • Unverified Ownership CWE