CVE-2026-44187

The record

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text within the user's configuration file and writes it to output log files. This information disclosure can lead to the attacker obtaining the API credential and potentially consuming the user's API quota.

Affected packages

Related vulnerabilities

• CVE-2026-86715 Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics… CWE-256
• CVE-2026-103094 ServiceNow has remediated an information disclosure vulnerability that was identified in… CWE-256
• CVE-2026-110975 A flaw was found in Kruize Autotune. CWE-256
• CVE-2026-19051 Plaintext storage of a password vulnerability in Menulux Software Inc. CWE-256
• CVE-2026-15933 OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. CWE-256
• CVE-2021-38489 HDD password plaintext is stored in a UEFI variable. CWE-256
• CVE-2026-55164 Lemur manages TLS certificate creation. CWE-256
• CVE-2026-50641 Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the… CWE-256