CVE-2026-108857 in Text Embeddings Inference
Summary
by MITRE • 10/11/2026
Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OTLP telemetry can recover the Bearer token and call the protected embedding and rerank endpoints.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The Hugging Face Text Embeddings Inference software version 1.9.4 contains a critical information disclosure vulnerability stemming from improper handling of sensitive authentication credentials within its logging mechanisms. This flaw is classified under CWE-532, which pertains to the insertion of sensitive information into log files for diagnostic or auditing purposes. The root cause lies in the architectural design of the router component, specifically within the Args struct that manages configuration parameters. While this structure correctly handles many security-sensitive inputs by masking them during logging operations, it fails to apply similar redaction protocols to the api_key field. Consequently, when the application initializes or processes requests involving authentication tokens, the raw value of the configured API key is written directly into standard output streams and log files without any obfuscation or encryption.
This vulnerability creates a significant operational risk for organizations deploying this inference service in production environments. Attackers who gain access to server logs, container stdout/stderr outputs, or OpenTelemetry (OTLP) telemetry data can easily extract the plaintext Bearer token. The presence of such tokens in log aggregates is particularly dangerous because these systems are often centralized and accessible by a wide range of personnel, including DevOps engineers, monitoring tools, and third-party logging services like Splunk or Datadog. Once an attacker recovers the API key from these logs, they can authenticate against the protected embedding and rerank endpoints. This unauthorized access allows them to perform inference operations using the victim's quota and potentially exfiltrate sensitive data processed by the model, leading to a complete compromise of confidentiality and integrity for the associated Hugging Face account resources.
From an attack perspective, this vulnerability aligns with ATT&CK technique T1530, Data from Cloud Storage Object or Service, as it involves accessing stored information (logs) that contain sensitive credentials. It also relates to T1602, Log Tampering, in the context of potential log injection if an attacker can influence input data, though the primary issue here is passive exfiltration via existing logs. The impact extends beyond simple credential theft; since API keys often carry rate limits and billing implications, their exposure could lead to financial loss through unauthorized compute usage or service disruption due to quota exhaustion by malicious actors.
To mitigate this vulnerability, immediate remediation involves upgrading the Hugging Face Text Embeddings Inference software to a version where the Args struct has been patched to include redaction logic for sensitive fields such as api_key. Until an official patch is available, organizations should implement strict access controls on log storage systems and container output streams to ensure that only authorized security personnel can view these logs. Additionally, rotating the exposed API key immediately after discovery of a potential leak is essential to invalidate any tokens already harvested by attackers. Implementing environment variable masking in logging configurations or using dedicated secret management solutions like HashiCorp Vault or AWS Secrets Manager for injecting credentials at runtime rather than through configuration files that might be logged can further reduce the risk profile. Regular auditing of log outputs for sensitive data patterns should also be established as part of a comprehensive security hygiene practice to detect similar misconfigurations in other components.