What is the CVSS score of CVE-2026-44192?

CVE-2026-44192 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.2%.

Ansible Lightspeed CVE-2026-44192

EUVD-2026-47652 MEDIUM

Path Traversal (CWE-22)

2026-07-22 secalert@redhat.com

GHSA-v5cc-389h-39x6

Path Traversal Red Hat

6.6

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

6.6 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

vuln.today AI

7.3 HIGH

Upgraded I to H because the description explicitly confirms potential command execution and full system compromise, exceeding a file-write-only integrity impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Red Hat

6.6 MEDIUM

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 12:35 vuln.today

DescriptionCVE.org

A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent through indirect prompt injection. By doing so, the attacker can cause the server to write files to unauthorized locations on the user's system. This can result in the exposure of sensitive host information and enable the attacker to execute malicious commands, potentially leading to a full system compromise.

AnalysisAI

Path traversal via indirect prompt injection in the Ansible Lightspeed Model Context Protocol (MCP) server allows an attacker to manipulate an AI agent into writing files to unauthorized filesystem locations on the user's system. Specifically affected is the Lightspeed MCP server component; the attack leverages poisoned content processed by the agent rather than a direct network request. Successful exploitation can expose sensitive host information and enable execution of malicious commands, potentially resulting in full system compromise. No public exploit identified at time of analysis.

Technical ContextAI

The Ansible Lightspeed MCP server implements the Model Context Protocol, a framework allowing AI agents to interact with tools and system resources. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), meaning the server fails to canonicalize or sanitize file paths supplied through agent instructions, allowing sequences such as '../' to escape the intended working directory. The attack mechanism is indirect prompt injection: malicious instructions embedded in content the AI agent is directed to process (e.g., a repository file, tool output, or external data source) are interpreted as legitimate agent commands. This is distinct from direct prompt injection, as the user does not knowingly submit the malicious payload - the agent processes it on their behalf. The CVSS local attack vector (AV:L) reflects that the MCP server operates on the user's local system and the poisoned content must reach the agent through local or agent-mediated channels. No CPE strings were provided in the available data.

Affected ProductsAI

The Ansible Lightspeed Model Context Protocol (MCP) server is affected. Exact vulnerable version ranges are not specified in the available data - no CPE strings were provided and no specific version numbers appear in the references. The vulnerability is tracked by Red Hat at https://access.redhat.com/security/cve/CVE-2026-44192 and in Red Hat Bugzilla at https://bugzilla.redhat.com/show_bug.cgi?id=2466760. Administrators should consult these sources for definitive affected version ranges as they are updated.

RemediationAI

No confirmed patch version is available from the provided data. Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-44192 and Red Hat Bugzilla bug #2466760 for the latest patch status and fix version once published. As interim compensating controls: restrict the filesystem directories accessible to the Ansible Lightspeed MCP server using mandatory access controls such as SELinux policies, AppArmor profiles, or a chroot jail, limiting the blast radius of any path traversal to a confined directory tree - note this adds operational complexity and may require tuning for legitimate agent operations. Avoid running the MCP server with write permissions to sensitive directories (e.g., home directories, configuration paths, credential stores) beyond the minimum required. Treat all external content processed by the AI agent as potentially untrusted and review agent task inputs from third-party sources. If the MCP server is not operationally required, disabling it entirely is the most effective interim mitigation with no functional trade-off for teams not using Lightspeed AI features.