CVE-2026-108857
MEDIUM
4,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
LOW
3,3
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none
Description
AI Translation Available
Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OTLP telemetry can recover the Bearer token and call the protected embedding and rerank endpoints.
532
Insertion of Sensitive Information into Log File
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Application Data
Applicable Platforms
All platforms may be affected
https://github.com/huggingface/text-embeddings-inference
https://github.com/huggingface/text-embeddings-inference/blob/e80ef225ed0e6cb17…
https://github.com/huggingface/text-embeddings-inference/blob/e80ef225ed0e6cb17…
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/huggingface-text-embeddings-inference…
https://www.vulncheck.com/advisories/hugging-face-text-embeddings-inference-thr…