CVE-2026-44209: Masci Banks

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt() are vulnerable to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE) on the host system. This vulnerability is fixed in 2.4.2.

Affected products

• Masci Banks: before 2.4.2 (fixed in 2.4.2)
• Red Hat Exploit Intelligence
• Red Hat Openshift Lightspeed
• Red Hat Red Hat Ansible Automation Platform 2

Published 2026-05-26. Last modified 2026-07-24.