Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Sensitive Information Exposure in LangSmith [CVE-2026-41182]

Summary IBM Watson Speech Services Cartridge is vulnerable to Sensitive Information Exposure in LangSmith, due to an issue that causes a bypass of the redaction pipeline CVE-2026-41182. LangSmith is used in our runtime postprocessor. This vulnerability has been addressed. Please read the details...

CVE-2026-41182

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls hideOutputs in JS, hideoutputs in Python do not apply to streaming token events. When ...

SUSE CVE-2026-41182

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls hideOutputs in JS, hideoutputs in Python do not apply to streaming token events. When ...

CVE-2026-41182

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls hideOutputs in JS, hideoutputs in Python do not apply to streaming token events. When ...

CVE-2026-41182

Summary: The CVE affects LangSmith Client SDKs (JavaScript and Python) prior to specific fixes. When a run produces streaming output, each token in the stream is stored as a separate new_token event containing the raw token value, bypassing the SDK’s output redaction. The redaction controls (hide...

LangSmith SDK: Streaming token events bypass output redaction

Summary The LangSmith SDK's output redaction controls hideOutputs in JS, hideoutputs in Python do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a newtoken event containing the raw token value. These events bypass the redaction pipeline...