Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A security flaw was identified in the Ansible Lightspeed API conversation endpoints that handle AI chat interactions. The APIs do not properly verify whether a conversation identifier belongs to the authenticated user making the request. As a result, an attacker with valid credentials could access or influence conversations owned by other users. This exposes sensitive conversation data and allows unauthorized manipulation of AI-generated outputs.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- ansible-automation-platform-26/lightspeed-rhel9
Version range not reported
- ansible-automation-platform-24/de-minimal-rhel8
Version range not reported
- ansible-automation-platform-24/de-minimal-rhel9
Version range not reported
- ansible-automation-platform-24/de-supported-rhel8
Version range not reported
- ansible-automation-platform-24/de-supported-rhel9
Version range not reported
- ansible-automation-platform-24/ee-minimal-rhel8
Version range not reported
- ansible-automation-platform-24/ee-minimal-rhel9
Version range not reported
- ansible-automation-platform-24/ee-supported-rhel8
Version range not reported
- ansible-automation-platform-24/ee-supported-rhel9
Version range not reported
- ansible-automation-platform-24/lightspeed-rhel8
Version range not reported
- ansible-automation-platform-24/platform-resource-runner-rhel8
Version range not reported
- ansible-automation-platform-25/aap-cloud-metrics-collector-rhel8
Version range not reported
- ansible-automation-platform-25/ansible-dev-tools-rhel8
Version range not reported
- ansible-automation-platform-25/de-minimal-rhel8
Version range not reported
- ansible-automation-platform-25/de-minimal-rhel9
Version range not reported
- ansible-automation-platform-25/de-supported-rhel8
Version range not reported
- ansible-automation-platform-25/de-supported-rhel9
Version range not reported
- ansible-automation-platform-25/ee-cloud-services-rhel9
Version range not reported
- ansible-automation-platform-25/ee-minimal-rhel8
Version range not reported
- ansible-automation-platform-25/ee-minimal-rhel9
Version range not reported
- ansible-automation-platform-25/ee-supported-rhel8
Version range not reported
- ansible-automation-platform-25/ee-supported-rhel9
Version range not reported
- ansible-automation-platform-25/lightspeed-rhel8
Version range not reported
- ansible-automation-platform-25/platform-resource-runner-rhel8
Version range not reported
- ansible-automation-platform-26/ansible-dev-tools-rhel9
Version range not reported
- ansible-automation-platform-26/de-minimal-rhel9
Version range not reported
- ansible-automation-platform-26/de-supported-rhel9
Version range not reported
- ansible-automation-platform-26/ee-minimal-rhel9
Version range not reported
- ansible-automation-platform-26/ee-supported-rhel9
Version range not reported
- ansible-automation-platform-26/mcp-tools-rhel9
Version range not reported
- ansible-automation-platform-26/platform-resource-runner-rhel9
Version range not reported
- ansible-automation-platform/ee-minimal-rhel8
Version range not reported
- ansible-automation-platform/ee-minimal-rhel9
Version range not reported
- ansible-automation-platform-tech-preview/ansible-devspaces-rhel9
Version range not reported