CVE-2026-44188 is a session management vulnerability in Red Hat Ansible Automation Platform 2.7's Ansible Lightspeed component. It stems from insufficient session expiration where OAuth access tokens remain valid on the backend after client logout. An attacker who exfiltrates a valid token prior to logout can continue to authenticate and access sensitive data with read-only privileges. The vulnerability impacts confidentiality by allowing unauthorized read access to inventories, playbooks, and configuration data. Red Hat has classified this as a moderate severity issue with a CVSS v3 base score of 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). No effective mitigation or patch is currently available, and users are advised to apply all previously released errata and monitor Red Hat advisories for updates.

The vulnerability allows persistent unauthorized read-only access to Ansible Automation Platform resources if an attacker obtains a valid OAuth token before user logout. This compromises data confidentiality but does not affect integrity or availability. The token remains valid until its natural expiration because the backend fails to invalidate it on logout. There are no known exploits in the wild at this time.

Currently, no mitigation or patch meets Red Hat's criteria for ease of use, applicability, or stability. Users should ensure all previously released errata relevant to their system are applied and monitor Red Hat advisories for future updates. Red Hat recommends reviewing this issue with a Technical Account Manager if available. No immediate action is mandated beyond applying existing updates and following vendor guidance.