CyberRota Analysis
AI-GeneratedThe vulnerability affects Hugging Face Text Embeddings Inference version 1.9.4, where a cleartext logging issue exposes the configured api_key due to the absence of a redact attribute in the router's Args struct. This flaw allows attackers with access to router logs, container output, or OTLP telemetry to retrieve the Bearer token, potentially compromising access to protected embedding and rerank endpoints. Organizations utilizing this version should prioritize remediation to safeguard sensitive API credentials and prevent unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OTLP telemetry can recover the Bearer token and call the protected embedding and rerank endpoints.