The Ansible Lightspeed extension for Visual Studio Code insecurely stores the Google Gemini API key in plaintext in user configuration files and output logs. This information disclosure vulnerability allows an attacker with local access or malware running with the user's privileges to obtain the API key. The vulnerability affects Red Hat Ansible Automation Platform 2. The CVSS 3.1 base score is 3.3 (low severity) with attack vector local, low complexity, low privileges required, no user interaction, and impacts confidentiality only. No official remediation or patch has been confirmed as of the published date. The vendor advisory is available but does not specify a fix or mitigation.

An attacker with local access or malware running with the user's privileges can read the plaintext Google Gemini API key from configuration files and logs. This can lead to unauthorized consumption of the user's API quota. The impact is limited to confidentiality loss and does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-44187 for current remediation guidance. Until a fix is available, limit local access to trusted users and avoid running untrusted code with user privileges to reduce risk. Monitor for updates from Red Hat regarding official fixes or mitigations.