SB2026073112 - IBM Watson Speech Services Cartridge update for LangSmith

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026073112

SB2026073112 - IBM Watson Speech Services Cartridge update for LangSmith

Published: July 31, 2026

Security Bulletin ID SB2026073112
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-41182)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log data in streaming token event handling when processing streaming LLM output. A remote attacker can trigger streaming output so that raw token values are recorded in new_token events to disclose sensitive information.

The issue affects both the JavaScript and Python SDK implementations, where output redaction applies to inputs and outputs fields but not to the events array.


Remediation

Install update from vendor's website.

References