Back to overview

CVE-2026-44192

MEDIUM
6.6
CVSS 3.1
Description
A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent through indirect prompt injection. By doing so, the attacker can cause the server to write files to unauthorized locations on the user's system. This can result in the exposure of sensitive host information and enable the attacker to execute malicious commands, potentially leading to a full system compromise.

Metadata

CVE ID
CVE-2026-44192
State
PUBLISHED
Assigner
redhat
Reserved
2026-05-05 15:02 UTC
Published
2026-07-22 12:06 UTC
Last updated
2026-07-22 13:05 UTC
Primary CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory …
Vendor / Product
Red Hat / Red Hat Ansible Automation Platform 2
Sources
cve.org  ·  NVD

Severity & Metrics

6.6 MEDIUM CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (3)
VendorProductPlatformVersions
Red Hat Red Hat Ansible Automation Platform 2 — —
Red Hat Red Hat Ansible Automation Platform 2 — —
Red Hat Red Hat Ansible Automation Platform 2 — —
Weakness (CWE)
CWESourceDescription
CWE-22 cna Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS scores (1)
ScoreSeverityVersionSourceVector
6.6 MEDIUM 3.1 cna CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
References (2)
Back to overview