{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-0598", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-01-05T07:35:27.017Z", "datePublished": "2026-02-06T05:47:57.105Z", "dateUpdated": "2026-05-04T21:20:14.612Z" }, "containers": { "cna": { "title": "Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api", "metrics": [ { "other": { "content": { "value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "format": "CVSS" } ], "descriptions": [ { "lang": "en", "value": "A security flaw was identified in the Ansible Lightspeed API conversation endpoints that handle AI chat interactions. The APIs do not properly verify whether a conversation identifier belongs to the authenticated user making the request. As a result, an attacker with valid credentials could access or influence conversations owned by other users. This exposes sensitive conversation data and allows unauthorized manipulation of AI-generated outputs." } ], "affected": [ { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "ansible-automation-platform-26/lightspeed-rhel9", "defaultStatus": "affected", "versions": [ { "version": "1777387242", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2.6::el9" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/de-minimal-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/de-minimal-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/de-supported-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/de-supported-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/ee-minimal-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/ee-minimal-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/ee-supported-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/ee-supported-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/lightspeed-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-24/platform-resource-runner-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/aap-cloud-metrics-collector-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/ansible-dev-tools-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/de-minimal-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/de-minimal-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/de-supported-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/de-supported-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/ee-cloud-services-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/ee-minimal-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/ee-minimal-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/ee-supported-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/ee-supported-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/lightspeed-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-25/platform-resource-runner-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/ansible-dev-tools-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/de-minimal-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/de-supported-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/ee-minimal-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/ee-supported-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/mcp-tools-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-26/platform-resource-runner-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform/ee-minimal-rhel8", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform/ee-minimal-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] }, { "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ansible-automation-platform-tech-preview/ansible-devspaces-rhel9", "defaultStatus": "unaffected", "cpes": [ "cpe:/a:redhat:ansible_automation_platform:2" ] } ], "references": [ { "url": "https://access.redhat.com/errata/RHSA-2026:13545", "name": "RHSA-2026:13545", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0598", "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427094", "name": "RHBZ#2427094", "tags": [ "issue-tracking", "x_refsource_REDHAT" ] } ], "datePublic": "2026-02-06T00:00:00.000Z", "problemTypes": [ { "descriptions": [ { "cweId": "CWE-283", "description": "Unverified Ownership", "lang": "en", "type": "CWE" } ] } ], "x_redhatCweChain": "CWE-283: Unverified Ownership", "workarounds": [ { "lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability." } ], "timeline": [ { "lang": "en", "time": "2026-01-05T07:34:33.335Z", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2026-02-06T00:00:00.000Z", "value": "Made public." } ], "credits": [ { "lang": "en", "value": "Red Hat would like to thank Laura Pardo (RedHat) for reporting this issue." } ], "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-05-04T21:20:14.612Z" }, "x_generator": { "engine": "cvelib 1.8.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-02-06T15:41:36.506274Z", "id": "CVE-2026-0598", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T15:42:21.423Z" } } ] } }