Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OTLP telemetry can recover the Bearer token and call the protected embedding and rerank endpoints.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
hugging face:text embeddings inference
References 5
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/huggingface-text-embeddings-inference…
NVD
https://github.com/huggingface/text-embeddings-inference/blob/e80ef225ed0e6cb17…
NVD
https://github.com/huggingface/text-embeddings-inference/blob/e80ef225ed0e6cb17…
NVD
https://github.com/huggingface/text-embeddings-inference
NVD
https://www.vulncheck.com/advisories/hugging-face-text-embeddings-inference-thr…
VulnCheck Advisory: Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging