Ansible Lightspeed EUVD-2026-36702

Exploitation requires an attacker to first successfully exfiltrate a valid OAuth access token from an active Ansible Lightspeed session - for example, through network interception (man-in-the-middle on a non-TLS path), access to server-side or client-side logs where tokens are written, or memory inspection on an endpoint running the AAP client. The target environment must be running Red Hat Ansible Automation Platform 2.x with the Ansible Lightspeed component active. The exfiltration must occur while the token is still valid (i.e., before natural expiration). Exploitation is limited to read access only - no write, delete, or command-execution capability is implied. The CVSS vector (PR:L) indicates the attack model assumes some level of access to the environment is held by the attacker, consistent with the token-exfiltration prerequisite. There is no user interaction required after the token is obtained. The absence of scope change (S:U) means impact is contained to the Ansible Lightspeed component and its directly accessible resources.

The NVD-assigned CVSS 3.1 score of 5.3 (Medium) reflects the real-world risk profile reasonably well. The AV:N vector confirms the attack path is network-based, but AC:H is the critical mitigating factor: an attacker must first exfiltrate a valid OAuth token through a separate step before this vulnerability becomes exploitable, raising the bar significantly. PR:L indicates some level of privileged access to the environment is assumed in the attack chain. C:H reflects full confidentiality exposure on the vulnerable component once exploitation occurs, which is the most concerning dimension. There is no integrity or availability impact (I:N/A:N). No EPSS score was provided in source intelligence - exploitation probability cannot be quantified from available data. No CISA KEV listing and no public POC have been identified, suggesting this is not being mass-exploited. The realistic risk is moderate and operationally conditional: it is most dangerous in environments with poor token hygiene, overly long token lifetimes, or where token exfiltration via logs or network interception is already a plausible threat vector.

An attacker who has previously established a foothold - for example, via network interception, access to application logs, or memory scraping on a host running the Ansible Automation Platform client - intercepts a valid Lightspeed OAuth access token during an active user session. After the legitimate user logs out, the attacker submits API requests using the exfiltrated token and continues to receive authorized responses, reading sensitive Ansible inventories, playbooks, and configuration data until the token naturally expires. No public POC has been identified, but the attack requires only standard OAuth bearer token usage against an unpatched endpoint.