CVE-2026-107717

A MODERATE severity vulnerability was found in the banks Python library, which is used by Red Hat Lightspeed and Ansible lightspeed offerings to generate prompts for Large Language Models (LLMs). The banks library attempts to parse every line of rendered template output as ChatMessage JSON without restricting message roles. When an application renders attacker-controlled input through a banks template and passes the resulting messages to an LLM provider, a remote attacker requiring no privileges or user interaction can submit crafted JSON that crosses the prompt boundary and is interpreted as privileged system, assistant, or tool messages. This can override application instructions, alter the intended prompt structure, and manipulate downstream model behavior, impacting the confidentiality and integrity of the LLM-driven application. Red Hat rates this flaw as MODERATE with a CVSS 3.1 score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), consistent with the upstream severity assessment.

The banks library as shipped in Lightspeed Core 0.6 and 0.7 (rag-tool containers), OpenShift Lightspeed 1 (lightspeed-ocp-rag container), Red Hat Ansible Automation Platform 2.5 (lightspeed-chatbot container), and Exploit Intelligence (vulnerability-analysis container) is affected. For the Lightspeed Core and OpenShift Lightspeed streams the fix is deferred because this is a moderate-severity flaw with a CVSS score below 7.0, for which Red Hat does not file trackers; the residual risk is that an attacker able to control data rendered through a banks template could inject privileged chat messages into prompts sent to an LLM. The Ansible Automation Platform 2.5 and Exploit Intelligence affected components are in streams that are out of support scope. Other OpenShift Lightspeed components that ship banks versions in which the vulnerable code is not present are not affected.