CVE-2026-107717

[CVE catalog]

A flaw was found in banks. When generating chat messages for Large Language Models (LLMs), the library attempts to parse every rendered template line as structured data without restricting message roles. A remote attacker can exploit this flaw by submitting crafted input that is interpreted as privileged system, assistant, or tool messages. Consequently, an attacker can bypass prompt boundaries, override application instructions, and manipulate downstream model behavior. banks: banks: Chat role injection via untrusted template input A MODERATE severity vulnerability was found in the banks Python library, which is used by Red Hat Lightspeed and Ansible lightspeed offerings to generate prompts for Large Language Models (LLMs). The banks library attempts to parse every line of rendered template output as ChatMessage JSON without restricting message roles. When an application renders attacker-controlled input through a banks template and passes the resulting messages to an LLM provider, a remote attacker requiring no privileges or user interaction can submit crafted JSON that crosses the prompt boundary and is interpreted as privileged system, assistant, or tool messages. This can override application instructions, alter the intended prompt structure, and manipulate downstream model behavior, impacting the confidentiality and integrity of the LLM-driven application. Red Hat rates this flaw as MODERATE with a CVSS 3.1 score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), consistent with the upstream severity assessment. The banks library as shipped in Lightspeed Core 0.6 and 0.7 (rag-tool containers), OpenShift Lightspeed 1 (lightspeed-ocp-rag container), Red Hat Ansible Automation Platform 2.5 (lightspeed-chatbot container), and Exploit Intelligence (vulnerability-analysis container) is affected. For the Lightspeed Core and OpenShift Lightspeed streams the fix is deferred because this is a moderate-severity flaw with a CVSS score below 7.0, for which Red Hat does not file trackers; the residual risk is that an attacker able to control data rendered through a banks template could inject privileged chat messages into prompts sent to an LLM. The Ansible Automation Platform 2.5 and Exploit Intelligence affected components are in streams that are out of support scope. Other OpenShift Lightspeed components that ship banks versions in which the vulnerable code is not present are not affected. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Published

Oct 8, 2026, 9:38:07 PM UTC

Updated

Oct 8, 2026, 10:17:27 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.34% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "banks",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.0"
            }
          ]
        }
      ],
      "versions": [
        "0.0.1",
        "0.0.2",
        "0.0.3",
        "0.1.0",
        "0.1.1",
        "0.2.0",
        "0.3.0",
        "0.3.1",
        "0.4.1",
        "0.5.0",
        "0.6.0",
        "1.0.0",
        "1.1.0",
        "1.2.0",
        "1.2.1",
        "1.3.0",
        "1.4.0",
        "1.5.0",
        "1.6.0",
        "1.6.1",
        "1.7.0",
        "1.7.1",
        "1.8.0",
        "2.0.0",
        "2.1.0",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "2.2.0",
        "2.3.0",
        "2.4.0",
        "2.4.1",
        "2.4.2",
        "2.4.3",
        "2.4.4",
        "2.4.5"
      ],
      "ecosystem": "PyPI",
      "fixed_version": "2.5.0",
      "provider_record_id": "PYSEC-2026-4202"
    },
    {
      "name": "banks",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.0"
            }
          ]
        }
      ],
      "versions": [
        "0.0.1",
        "0.0.2",
        "0.0.3",
        "0.1.0",
        "0.1.1",
        "0.2.0",
        "0.3.0",
        "0.3.1",
        "0.4.1",
        "0.5.0",
        "0.6.0",
        "1.0.0",
        "1.1.0",
        "1.2.0",
        "1.2.1",
        "1.3.0",
        "1.4.0",
        "1.5.0",
        "1.6.0",
        "1.6.1",
        "1.7.0",
        "1.7.1",
        "1.8.0",
        "2.0.0",
        "2.1.0",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "2.2.0",
        "2.3.0",
        "2.4.0",
        "2.4.1",
        "2.4.2",
        "2.4.3",
        "2.4.4",
        "2.4.5"
      ],
      "ecosystem": "PyPI",
      "fixed_version": "2.5.0",
      "provider_record_id": "GHSA-HMQ2-7HP6-7CRH"
    }
  ]
}