{"data":{"id":"d17e0822-cf11-4018-b0a8-844075d76d40","title":"CVE-2026-44192: A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path…","summary":"CVE-2026-44192 is a path traversal flaw in the Ansible Lightspeed Model Context Protocol (MCP) server, classified as CWE-22. An attacker can use indirect prompt injection to manipulate an AI agent, causing the server to write files to unauthorized locations on the user's system. The source says this can expose sensitive host information and enable execution of malicious commands, potentially leading to full system compromise.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44192","publishedAt":"2026-07-22T12:18:00.063Z","cveId":"CVE-2026-44192","cweIds":["CWE-22"],"cvssScore":"6.6","cvssSeverity":"medium","severity":"medium","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Ansible Lightspeed","Model Context Protocol (MCP) server"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Ansible Lightspeed MCP server path traversal via indirect prompt injection","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","attackVector":"local","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00198,"epssCheckedAt":"2026-11-12T18:09:37.393Z","kevDateAdded":null,"advisoryAliases":["GHSA-v5cc-389h-39x6"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T18:09:54.425Z","patchAvailable":null,"disclosureDate":"2026-07-22T12:18:00.063Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[]}}