Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to incomplete validation in LangChain [CVE-2026-40087]

Summary IBM Watson Speech Services Cartridge is vulnerable to incomplete validation in LangChain, due to flaws in the f-string prompt-template. CVE-2026-40087. LangChain is used in our speech runtimes. This vulnerability has been addressed. Please read the details for remediation below...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses pdfminersix-20251107-py3-none-any.whl, requests-2.32.5-py3-none-any.whl, langchaincore-0.3.81-py3-none-any.whl, pythondotenv-1.0.1-py3-none-any.whl, langchaintextsplitters-0.3.11-py3-none-any.whl, qs-6.15.1.tgz, idna-3.10-py3-none-any.whl, idna-3.14-py3-none-any.whl...

ROOT-APP-PYPI-CVE-2026-40087 CVE-2026-40087 in rootio-langchain-core - Patched by Root

Root has patched CVE-2026-40087 in the rootio-langchain-core package for Root:PyPI. Multiple fixed versions available...

CVE-2026-40087 vulnerabilities

Vulnerabilities for packages: py3-langchain, open-webui...

CVE-2026-40087 LangChain has incomplete f-string validation in prompt templates

LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same...