Text Embeddings Inference
Monthly
Cleartext logging in Hugging Face Text Embeddings Inference through 1.9.4 exposes the configured api_key because the router's Args struct lacks a redact attribute for that field. Attackers who already have read access to router startup logs, container output, or OTLP telemetry can recover the Bearer token and use it to call protected embedding and rerank endpoints. This is a modest-severity, local information-disclosure issue (CWE-532) with no direct integrity or availability impact; no public exploit code or confirmed active exploitation is identified at time of analysis.
Cleartext logging in Hugging Face Text Embeddings Inference through 1.9.4 exposes the configured api_key because the router's Args struct lacks a redact attribute for that field. Attackers who already have read access to router startup logs, container output, or OTLP telemetry can recover the Bearer token and use it to call protected embedding and rerank endpoints. This is a modest-severity, local information-disclosure issue (CWE-532) with no direct integrity or availability impact; no public exploit code or confirmed active exploitation is identified at time of analysis.