CVE-2026-0598— Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api

Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api

A security flaw was identified in the Ansible Lightspeed API conversation endpoints that handle AI chat interactions. The APIs do not properly verify whether a conversation identifier belongs to the authenticated user making the request. As a result, an attacker with valid credentials could access or influence conversations owned by other users. This exposes sensitive conversation data and allows unauthorized manipulation of AI-generated outputs.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

未经验证的属主

Red Hat Ansible Automation Platform 2 安全漏洞

Red Hat Ansible Automation Platform 2是美国红帽（Red Hat）公司的一款构建、部署和管理自动化的软件。 Red Hat Ansible Automation Platform 2存在安全漏洞，该漏洞源于处理AI聊天交互的对话端点未正确验证会话标识符是否属于发出请求的已认证用户，可能导致拥有有效凭据的攻击者访问或影响其他用户的对话，从而暴露敏感数据或进行未授权操作。

N/A

N/A