Skip to content

🔒 [IBM OSPO Security Notification] — IBM/AssetOpsBench #580

Open
Open
🔒 [IBM OSPO Security Notification] — IBM/AssetOpsBench#580
Labels
security

Description

@security-ops-bot
security-ops-bot
bot
opened on Sep 29, 2026

🔒 [IBM OSPO Security Notification] — IBM/AssetOpsBench

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.

Attention: @ShuxinLin @DhavalRepo18

Dependabot Alerts

Severity CVE/GHSA Package Affected Patched Deadline Fix PR
🔴 critical CVE-2026-96620 claude-agent-sdk < 0.2.121 0.2.121 2026-10-27 PR
🟠 high CVE-2026-25990 pillow >= 10.3.0, < 12.1.1 12.1.1 2026-11-12 —
🟠 high CVE-2026-40192 pillow >= 10.3.0, < 12.2.0 12.2.0 2026-11-12 —
🟠 high CVE-2026-42311 pillow >= 10.3.0, < 12.2.0 12.2.0 2026-11-12 —
🟠 high CVE-2026-44843 langchain-core >= 1.0.0, <= 1.3.2 1.3.3 2026-11-12 —
🟠 high CVE-2026-44431 urllib3 >= 1.23, < 2.7.0 2.7.0 2026-11-12 PR
🟠 high CVE-2026-44432 urllib3 >= 2.6.0, < 2.7.0 2.7.0 2026-11-12 PR
🟠 high CVE-2026-45134 langsmith < 0.8.0 0.8.0 2026-11-12 —
🟠 high GHSA-537c-gmf6-5ccf cryptography >= 0.5.0, < 48.0.1 48.0.1 2026-11-12 PR
🟠 high GHSA-f4xh-w4cj-qxq8 langsmith < 0.8.18 0.8.18 2026-11-12 —
🟠 high CVE-2026-4372 transformers < 5.3.0 5.3.0 2026-11-12 PR
🟠 high CVE-2026-5241 transformers < 5.5.0 5.5.0 2026-11-12 PR
🟠 high CVE-2026-52870 mcp >= 1.23.0, <= 1.27.1 1.27.2 2026-11-12 PR
🟠 high CVE-2026-52869 mcp <= 1.27.1 1.27.2 2026-11-12 PR
🟠 high CVE-2026-59950 mcp < 1.28.1 1.28.1 2026-11-12 PR
🟠 high CVE-2026-54058 pillow < 12.3.0 12.3.0 2026-11-12 —
🟠 high CVE-2026-54059 pillow < 12.3.0 12.3.0 2026-11-12 —
🟠 high CVE-2026-54060 pillow < 12.3.0 12.3.0 2026-11-12 —
🟠 high CVE-2026-55379 pillow < 12.3.0 12.3.0 2026-11-12 —
🟠 high CVE-2026-55380 pillow < 12.3.0 12.3.0 2026-11-12 —
🟠 high CVE-2026-59197 Pillow < 12.3.0 12.3.0 2026-11-12 —
🟠 high CVE-2026-59199 Pillow < 12.3.0 12.3.0 2026-11-12 —
🟠 high CVE-2026-59200 Pillow >= 5.1.0, < 12.3.0 12.3.0 2026-11-12 —
🟠 high CVE-2026-59204 pillow >= 8.2.0, < 12.3.0 12.3.0 2026-11-12 —
🟠 high CVE-2026-59205 pillow < 12.3.0 12.3.0 2026-11-12 —
🟠 high CVE-2026-59885 pyasn1 <= 0.6.3 0.6.4 2026-11-12 —
🟠 high CVE-2026-59886 pyasn1 <= 0.6.3 0.6.4 2026-11-12 —
🟠 high CVE-2026-73415 jupyterlab >= 4.6.0, <= 4.6.1 4.6.2 2026-11-12 PR
🟠 high CVE-2026-73417 jupyterlab >= 4.6.0, <= 4.6.1 4.6.2 2026-11-12 PR
🟠 high CVE-2026-59884 pyasn1 < 0.6.4 0.6.4 2026-11-12 —
🟠 high CVE-2026-69244 aiohttp <= 3.14.2 3.14.3 2026-11-12 —
🟠 high CVE-2026-69247 cryptography >= 44.0.0, < 50.0.0 50.0.0 2026-11-12 PR
🟠 high CVE-2026-9856 transformers < 5.10.0 5.10.0 2026-11-12 PR
🟠 high CVE-2026-82397 tornado <= 6.5.7 6.5.8 2026-11-12 PR
🟠 high CVE-2026-69249 cryptography >= 42.0.0, < 49.0.0 49.0.0 2026-11-12 PR
🟠 high CVE-2026-97687 urllib3 >= 1.26.0, < 2.8.0 2.8.0 2026-11-01 PR
🟠 high CVE-2026-97689 urllib3 >= 1.10.3, < 2.8.0 2.8.0 2026-11-01 PR
🟠 high CVE-2026-80047 transformers >= 4.49.0, <= 5.8.1 — 2026-11-01 —
🟠 high GHSA-c2m8-h5v5-343r tornado <= 6.5.8 6.5.9 2026-11-01 PR
🟠 high GHSA-chx6-46f5-w4vp tornado <= 6.5.8 6.5.9 2026-11-01 PR
🟠 high CVE-2026-102831 jupyterlab >= 4.6.0, <= 4.6.3 4.6.4 2026-11-01 PR
🟠 high CVE-2026-104873 langgraph-sdk >= 0.1.45, <= 0.4.3 0.4.4 2026-11-06 PR
🟠 high CVE-2026-104851 fsspec >= 0.9.0, < 2026.6.0 2026.6.0 2026-11-06 PR
🟠 high CVE-2026-111064 aiohttp <= 3.14.3 3.14.4 2026-11-19 —
🟠 high GHSA-2g87-pp6c-29x5 aiohttp <= 3.14.3 3.14.4 2026-11-19 —
🟡 medium CVE-2026-25645 requests < 2.33.0 2.33.0 2027-01-11 —
🟡 medium CVE-2026-22815 aiohttp <= 3.13.3 3.13.4 2027-01-11 —
🟡 medium CVE-2026-34515 aiohttp <= 3.13.3 3.13.4 2027-01-11 —
🟡 medium CVE-2026-34516 aiohttp <= 3.13.3 3.13.4 2027-01-11 —
🟡 medium CVE-2026-34525 aiohttp <= 3.13.3 3.13.4 2027-01-11 —
🟡 medium CVE-2026-1839 transformers < 5.0.0rc3 5.0.0rc3 2027-01-11 PR
🟡 medium CVE-2026-39892 cryptography >= 45.0.0, < 46.0.7 46.0.7 2027-01-11 PR
🟡 medium CVE-2025-71176 pytest < 9.0.3 9.0.3 2027-01-11 —
🟡 medium CVE-2026-28684 python-dotenv < 1.2.2 1.2.2 2027-01-11 —
🟡 medium CVE-2026-42309 pillow >= 11.2.1, < 12.2.0 12.2.0 2027-01-11 —
🟡 medium CVE-2026-42308 pillow < 12.2.0 12.2.0 2027-01-11 —
🟡 medium CVE-2026-42310 pillow >= 4.2.0, < 12.2.0 12.2.0 2027-01-11 —
🟡 medium CVE-2026-45409 idna < 3.15 3.15 2027-01-11 —
🟡 medium CVE-2026-34993 aiohttp < 3.14.0 3.14.0 2027-01-11 —
🟡 medium CVE-2026-47265 aiohttp < 3.14.0 3.14.0 2027-01-11 —
🟡 medium CVE-2026-54276 aiohttp <= 3.14.0 3.14.1 2027-01-11 —
🟡 medium CVE-2026-54277 aiohttp <= 3.14.0 3.14.1 2027-01-11 —
🟡 medium CVE-2026-54278 aiohttp <= 3.14.0 3.14.1 2027-01-11 —
🟡 medium CVE-2026-54273 aiohttp <= 3.14.0 3.14.1 2027-01-11 —
🟡 medium CVE-2026-54274 aiohttp <= 3.14.0 3.14.1 2027-01-11 —
🟡 medium CVE-2026-55443 langchain <= 1.3.8 1.3.9 2027-01-11 —
🟡 medium GHSA-4xgf-cpjx-pc3j pydantic-settings >= 2.12.0, < 2.14.2 2.14.2 2027-01-11 —
🟡 medium CVE-2026-48775 langgraph-checkpoint < 4.1.1 4.1.1 2027-01-11 —
🟡 medium CVE-2026-48776 langgraph-sdk < 0.3.15 0.3.15 2027-01-11 PR
🟡 medium CVE-2026-55798 Pillow < 12.3.0 12.3.0 2027-01-11 —
🟡 medium CVE-2026-59198 Pillow >= 5.2.0, < 12.3.0 12.3.0 2027-01-11 —
🟡 medium GHSA-h5v5-8746-g7mm jupyterlab >= 4.6.0, <= 4.6.1 4.6.2 2027-01-11 PR
🟡 medium CVE-2026-73416 jupyterlab >= 4.6.0, <= 4.6.1 4.6.2 2027-01-11 PR
🟡 medium CVE-2026-59881 aiohttp <= 3.14.1 3.14.2 2027-01-11 —
🟡 medium CVE-2026-69243 aiohttp <= 3.14.1 3.14.2 2027-01-11 —
🟡 medium GHSA-8423-8fgw-73vq tornado <= 6.5.7 6.5.8 2027-01-11 PR
🟡 medium CVE-2026-69112 accelerate <= 1.14.0 — 2027-01-11 —
🟡 medium CVE-2026-85999 soupsieve < 2.9.0 2.9.0 2027-01-11 PR
🟡 medium CVE-2026-86000 soupsieve < 2.9.0 2.9.0 2027-01-11 PR
🟡 medium CVE-2026-69248 cryptography >= 45.0.0, < 49.0.0 49.0.0 2027-01-11 PR
🟡 medium CVE-2026-84377 litellm >= 1.94.0, < 1.94.3 1.94.3 2026-12-31 —
🟡 medium CVE-2026-97688 urllib3 >= 2.6.2, < 2.8.0 2.8.0 2026-12-31 PR
🟡 medium GHSA-3hv7-mjh2-fv65 tornado <= 6.5.8 6.5.9 2026-12-31 PR
🟡 medium CVE-2026-102904 jupyterlab >= 4.6.0, <= 4.6.3 4.6.4 2026-12-31 PR
🟡 medium CVE-2026-102830 jupyterlab >= 4.6.0, <= 4.6.3 4.6.4 2026-12-31 PR
🟡 medium CVE-2026-66007 datasets < 5.0.1 5.0.1 2027-01-02 PR
🟡 medium CVE-2026-104874 multidict >= 6.7.0, <= 6.9.0 6.9.1 2027-01-05 PR
🟡 medium CVE-2026-102832 jupyterlab >= 4.6.0, <= 4.6.3 4.6.4 2027-01-18 PR
🟡 medium CVE-2026-59951 mcp >= 1.8.0, < 1.30.0 1.30.0 2027-01-18 PR

Code Scanning Alerts

Severity Rule Tool Deadline
🟡 medium actions/missing-workflow-permissions CodeQL 2026-12-28

Secret Scanning Alerts

No open secret scanning alerts.

Activity

  1. security-ops-bot
    added
    security
    on Sep 29, 2026

  2. security-ops-bot commented on Sep 29, 2026

    @security-ops-bot
    security-ops-botBot
    on Sep 29, 2026 – with security-ops-bot
    Author

    🔄 Code & Secret Scanning Alert Changes

    Added: cs-1 (code-scanning, medium)

  3. security-ops-bot commented on Oct 1, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 1, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-102274 (medium)

  4. security-ops-bot commented on Oct 2, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 2, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-42309 (medium), CVE-2026-42308 (medium), CVE-2026-42310 (medium), CVE-2026-53539 (high), CVE-2026-73416 (medium), CVE-2026-84377 (medium), CVE-2026-101917 (medium), CVE-2026-102271 (high), CVE-2026-102267 (high), CVE-2026-102268 (critical), CVE-2026-102269 (medium), CVE-2026-102270 (medium), CVE-2026-97687 (high), CVE-2026-97689 (high), CVE-2026-97688 (medium), CVE-2026-101918 (medium), CVE-2026-80047 (high), GHSA-c2m8-h5v5-343r (high), GHSA-chx6-46f5-w4vp (high), GHSA-3hv7-mjh2-fv65 (medium), CVE-2026-103001 (medium), CVE-2026-102831 (high), CVE-2026-102904 (medium), CVE-2026-102830 (medium)

  5. security-ops-bot commented on Oct 3, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 3, 2026 – with security-ops-bot
    Author

    ⚠️ SLA Warning — IBM/AssetOpsBench

    The following 3 alerts are approaching their SLA deadline with 3 days remaining. Please remediate before the deadline to avoid automatic repository archiving.

    To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

    Alert Severity Deadline
    CVE-2026-27962 critical 2026-10-06
    CVE-2026-32871 critical 2026-10-06
    CVE-2026-63374 critical 2026-10-06

    @ShuxinLin @DhavalRepo18

  6. security-ops-bot commented on Oct 4, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 4, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-66007 (medium)

    Resolved: CVE-2026-42309, CVE-2026-42308, CVE-2026-42310, CVE-2026-42311, CVE-2026-42561, CVE-2026-44843, CVE-2026-44431, CVE-2026-44432, GHSA-f4xh-w4cj-qxq8, GHSA-4xgf-cpjx-pc3j, CVE-2026-48775, CVE-2026-69243

  7. security-ops-bot commented on Oct 6, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 6, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2026-34073, CVE-2026-4539, CVE-2026-34513, CVE-2026-34514, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-50269, CVE-2026-54279, CVE-2026-54280, CVE-2026-54275, CVE-2026-53537, CVE-2026-53538, CVE-2026-53540, CVE-2026-54282, CVE-2025-3000, GHSA-whvh-wf3x-g77j, CVE-2026-48524, GHSA-wwv5-g3v4-889x

  8. security-ops-bot commented on Oct 6, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 6, 2026 – with security-ops-bot
    Author

    ⚠️ SLA Warning — IBM/AssetOpsBench

    The following alert is approaching their SLA deadline with 3 days remaining. Please remediate before the deadline to avoid automatic repository archiving.

    To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

    Alert Severity Deadline
    CVE-2026-102268 critical 2026-10-09

    @ShuxinLin @DhavalRepo18

  9. security-ops-bot commented on Oct 6, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 6, 2026 – with security-ops-bot
    Author

    🔒 Repository Archived — IBM/AssetOpsBench

    The following 3 alerts have exceeded their SLA deadline without being remediated. This repository has been archived.

    Alert Severity Deadline
    CVE-2026-27962 critical 2026-10-06
    CVE-2026-32871 critical 2026-10-06
    CVE-2026-63374 critical 2026-10-06

    To request unarchiving, contact your security team and provide a remediation plan.

    @ShuxinLin @DhavalRepo18

  10. security-ops-bot commented on Oct 7, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 7, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-104873 (high), CVE-2026-104851 (high), CVE-2026-104874 (medium)

    Resolved: CVE-2026-25990, CVE-2025-69872, CVE-2026-32597, CVE-2026-27962, CVE-2026-28490, CVE-2026-28498, CVE-2026-25645, CVE-2025-64340, CVE-2026-27124, CVE-2026-32871, CVE-2026-22815, CVE-2026-34515, CVE-2026-34516, CVE-2026-34525, CVE-2026-34444, CVE-2026-1839, CVE-2026-39892, CVE-2025-71176, CVE-2026-40192, CVE-2026-40347, CVE-2026-41425, CVE-2026-28684, CVE-2026-44681, CVE-2026-45134, CVE-2026-45409, CVE-2026-34993, CVE-2026-47265, CVE-2026-48710, CVE-2026-41479, CVE-2026-48523, CVE-2026-48526, CVE-2026-48525, CVE-2026-54276, CVE-2026-54277, CVE-2026-54278, CVE-2026-54273, CVE-2026-54274, GHSA-537c-gmf6-5ccf, CVE-2026-48817, CVE-2026-48818, CVE-2026-53539, CVE-2026-54283, CVE-2026-55443, CVE-2026-48776, CVE-2026-4372, CVE-2026-5241, CVE-2026-52870, CVE-2026-52869, CVE-2026-59950, CVE-2026-54058, CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380, CVE-2026-55798, CVE-2026-59197, CVE-2026-59198, CVE-2026-59199, CVE-2026-59200, CVE-2026-59204, CVE-2026-59205, CVE-2026-59885, CVE-2026-59886, GHSA-h5v5-8746-g7mm, CVE-2026-73416, CVE-2026-73415, CVE-2026-73417, CVE-2026-59884, CVE-2026-48522, CVE-2026-59881, CVE-2026-69244, CVE-2026-69247, CVE-2026-9856, GHSA-8423-8fgw-73vq, CVE-2026-82397, CVE-2026-69112, CVE-2026-85999, CVE-2026-86000, CVE-2026-64847, CVE-2026-63374, CVE-2026-69249, CVE-2026-69248, CVE-2026-102274, CVE-2026-101917, CVE-2026-102271, CVE-2026-102267, CVE-2026-102268, CVE-2026-102269, CVE-2026-102270, CVE-2026-101918, CVE-2026-103001

  11. Sagar-CK
    added a commit that references this issue on Oct 10, 2026

    fix: bump deps for 4 critical CVEs

    4e7e103

  12. security-ops-bot commented on Oct 13, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 13, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-25990 (high), CVE-2026-25645 (medium), CVE-2026-22815 (medium), CVE-2026-34515 (medium), CVE-2026-34516 (medium), CVE-2026-34525 (medium), CVE-2026-1839 (medium), CVE-2026-39892 (medium), CVE-2025-71176 (medium), CVE-2026-40192 (high), CVE-2026-28684 (medium), CVE-2026-42309 (medium), CVE-2026-42308 (medium), CVE-2026-42310 (medium), CVE-2026-42311 (high), CVE-2026-44843 (high), CVE-2026-44431 (high), CVE-2026-44432 (high), CVE-2026-45134 (high), CVE-2026-45409 (medium), CVE-2026-34993 (medium), CVE-2026-47265 (medium), CVE-2026-54276 (medium), CVE-2026-54277 (medium), CVE-2026-54278 (medium), CVE-2026-54273 (medium), CVE-2026-54274 (medium), GHSA-537c-gmf6-5ccf (high), CVE-2026-55443 (medium), GHSA-f4xh-w4cj-qxq8 (high), GHSA-4xgf-cpjx-pc3j (medium), CVE-2026-48775 (medium), CVE-2026-48776 (medium), CVE-2026-4372 (high), CVE-2026-5241 (high), CVE-2026-52870 (high), CVE-2026-52869 (high), CVE-2026-59950 (high), CVE-2026-54058 (high), CVE-2026-54059 (high), CVE-2026-54060 (high), CVE-2026-55379 (high), CVE-2026-55380 (high), CVE-2026-55798 (medium), CVE-2026-59197 (high), CVE-2026-59198 (medium), CVE-2026-59199 (high), CVE-2026-59200 (high), CVE-2026-59204 (high), CVE-2026-59205 (high), CVE-2026-59885 (high), CVE-2026-59886 (high), GHSA-h5v5-8746-g7mm (medium), CVE-2026-73416 (medium), CVE-2026-73415 (high), CVE-2026-73417 (high), CVE-2026-59884 (high), CVE-2026-59881 (medium), CVE-2026-69243 (medium), CVE-2026-69244 (high), CVE-2026-69247 (high), CVE-2026-9856 (high), GHSA-8423-8fgw-73vq (medium), CVE-2026-82397 (high), CVE-2026-69112 (medium), CVE-2026-85999 (medium), CVE-2026-86000 (medium), CVE-2026-69249 (high), CVE-2026-69248 (medium)

  13. security-ops-bot commented on Oct 20, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 20, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2026-102832 (medium), CVE-2026-59951 (medium), CVE-2026-96620 (critical), CVE-2026-111064 (high), GHSA-2g87-pp6c-29x5 (high)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    security

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions