Cleartext API key logging in Hugging Face Text Embeddings Inference
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-532.
Summary
Hugging Face Text Embeddings Inference through 1.9.4 writes the configured api_key to logs in cleartext because the router's Args struct lacks a redact attribute for it. This is insertion of sensitive information into a log file (CWE-532). An attacker with access to router logs, container output, or OTLP telemetry can recover the Bearer token and use it to call the protected embedding and rerank endpoints.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OTLP telemetry can recover the Bearer token and call the protected embedding and rerank endpoints.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| huggingface | Text Embeddings Inference | up to 1.9.4 | — | No fix listed | CNA |
- Text Embeddings Inference Vendorhuggingface Affected up to 1.9.4 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Hugging Face Text Embeddings Inference.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108857
- 2026-10-11 Alias added: GHSA-6w4q-53gw-556h
- 2026-10-13 CISA SSVC decision points changed
References
Advisory 1
Other 3
- https://github.com/huggingface/text-embeddings-inference/blob/e80ef225ed0e6cb1717ce632a6a84b6cf211bb67/router/src/main.rs#L170-L174
- https://github.com/huggingface/text-embeddings-inference/blob/e80ef225ed0e6cb1717ce632a6a84b6cf211bb67/router/src/main.rs#L204-L216
- https://github.com/huggingface/text-embeddings-inference
More huggingface vulnerabilities
- TI-2026-48351 sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False CVSS 4.0CRITICAL 9.3
- TI-2026-20914 LeRobot Unsafe Deserialization Remote Code Execution via gRPC CVSS 4.0CRITICAL 9.3
- TI-2026-04577 Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers CVSS 3.1CRITICAL 9.6
- TI-2025-04589 Sandbox Escape Vulnerability in huggingface/smolagents CVSS 3.1CRITICAL 10.0
- TI-2026-79938 Pickle deserialization in Hugging Face Datasets allows code execution CVSS 4.0HIGH 8.7
- TI-2026-32710 Diffusers: None.py Trust Remote Code Bypass CVSS 3.1HIGH 8.8
Sources
- CVE-2026-108857 · CVE Program
- CVE-2026-108857 · NVD
- FIRST EPSS
- GHSA-6w4q-53gw-556h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences