Hugging Face Text Embeddings Inference API Key Exposure

Executive Summary

This vulnerability is a cleartext logging issue in Hugging Face Text Embeddings Inference versions up to 1.9.4. The router's Args struct does not redact the api_key, causing it to be exposed in logs, container output, or OTLP telemetry. Attackers with access to these logs can recover the Bearer token and misuse it to call protected endpoints.

Useful 0 Not Useful 0

Detection Guidance

Check router logs, container output, or OTLP telemetry for exposed api_key values in plaintext. Search for Bearer token patterns in logs or environment variables.

Useful 0 Not Useful 0

Impact Analysis

If you use Hugging Face Text Embeddings Inference through version 1.9.4, an attacker with log access could steal your api_key. This could allow them to make unauthorized API calls to embedding and rerank endpoints, potentially leading to data breaches or service misuse.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Exposure of api_keys may result in non-compliance with confidentiality and integrity controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to a version of Hugging Face Text Embeddings Inference beyond 1.9.4 where the api_key is properly redacted in logs. Rotate any exposed api_key credentials immediately.

Useful 0 Not Useful 0