EUVD-2026-47653
GHSA-fxgw-9xvp-9r43
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local filesystem read requires existing user-level OS access (AV:L, PR:L); impact confined to a single third-party API credential with no integrity or availability consequences.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text within the user's configuration file and writes it to output log files. This information disclosure can lead to the attacker obtaining the API credential and potentially consuming the user's API quota.
AnalysisAI
Insecure credential storage in the Ansible Lightspeed VS Code extension exposes Google Gemini API keys to any local actor operating at user privilege level. The extension writes API keys in plaintext to both user configuration files and extension output log channels, making them readable by co-users of the workstation, other OS-level processes, or malware executing under the victim's account. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the primary real-world risk is API credential theft leading to unauthorized quota consumption or service abuse.
Technical ContextAI
The root cause is CWE-256 (Plaintext Storage of a Password), where sensitive credentials are persisted without encryption or OS-level secret store protection. The Ansible Lightspeed extension for Visual Studio Code integrates with the Google Gemini API to provide AI-assisted Ansible automation. Rather than delegating credential storage to the OS keychain or VS Code's SecretStorage API (which encrypts secrets at rest), the extension stores the Gemini API key as plaintext in the user's VS Code configuration directory and additionally echoes it into extension output log files. The CVSS vector AV:L/AC:L/PR:L/UI:N reflects that exploitation occurs entirely within the local filesystem context - no network access to the vulnerable system is required. No CPE strings were provided in the source data; affected versions must be confirmed via the Red Hat advisory.
Affected ProductsAI
The Ansible Lightspeed extension for Visual Studio Code is affected. No specific version range or CPE strings were provided in the available source data. The vulnerability was reported by Red Hat Product Security (secalert@redhat.com) and is tracked in Red Hat Bugzilla at bug ID 2466765. Authoritative affected version details must be retrieved from the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-44187 and the corresponding Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2466765.
RemediationAI
No exact patched release version was confirmed in the available source data - consult https://access.redhat.com/security/cve/CVE-2026-44187 and https://bugzilla.redhat.com/show_bug.cgi?id=2466765 for current patch status and a fixed version once published. As an immediate compensating control, any Google Gemini API key previously configured in the Ansible Lightspeed extension should be revoked and regenerated in the Google Cloud console, as the key may already reside in log files accessible to other local users or processes. Users should also manually inspect and clear VS Code extension log output files and the extension's configuration section to remove residual plaintext key material. On shared workstations, restrict filesystem permissions on the VS Code user profile directory and any writable log paths to prevent lateral read access by other OS accounts. Until a patched release is confirmed, consider avoiding persistent API key storage in the extension and instead supplying credentials only at session start if the extension's workflow permits it.
Same weakness CWE-256 – Plaintext Storage of a Password
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today