The vulnerability in Red Hat Ansible Automation Platform 2.6 involves the Ansible Lightspeed API conversation endpoints, which fail to verify that a conversation identifier belongs to the authenticated user making the request. This lack of ownership verification enables an attacker with valid credentials to access or manipulate conversations owned by other users. The CVSS v3.1 base score is 4.2 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact. Red Hat has published an official security advisory (RHSA-2026:13545) providing an update that fixes this issue.

An attacker with valid credentials can access or influence AI chat conversations of other users, potentially exposing sensitive conversation data and allowing unauthorized manipulation of AI-generated outputs. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Red Hat has released an official security update for Ansible Automation Platform 2.6 that addresses this vulnerability. Users should apply the update as described in the Red Hat advisory RHSA-2026:13545 and ensure all previously released errata are applied before upgrading. Patch status is confirmed as an official fix available from Red Hat. No additional mitigation steps are indicated beyond applying the vendor-provided update.