Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck
CVE-2026-108857Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging
Low 3.3
In plain English
A low-severity sensitive data in logs in Text Embeddings Inference from Hugging Face. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OTLP telemetry can recover the Bearer token and call the protected embedding and rerank endpoints.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hugging Face | Text Embeddings Inference | 0 – through 1.9.4 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/huggingface-text-embeddings-inference-api-key-startup-log third-party-advisory
- https://github.com/huggingface/text-embeddings-inference/blob/e80ef225ed0e6cb1717ce632a6a84b6cf211bb67/router/src/main.rs#L170-L174 technical-description
- https://github.com/huggingface/text-embeddings-inference/blob/e80ef225ed0e6cb1717ce632a6a84b6cf211bb67/router/src/main.rs#L204-L216 technical-description
- https://github.com/huggingface/text-embeddings-inference product
- VulnCheck Advisory: Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging third-party-advisory