CVE-2026-108857: Hugging Face TEI Information Disclosure

CVE-2026-108857 Overview

CVE-2026-108857 is a cleartext logging vulnerability in Hugging Face Text Embeddings Inference (TEI) through version 1.9.4. The router's Args struct lacks a redact attribute for the api_key field, causing the configured Bearer token to appear in startup logs, container output, and OpenTelemetry Protocol (OTLP) telemetry streams. Any actor with read access to those log destinations can recover the credential and invoke the protected /embed and /rerank endpoints. The weakness is classified under [CWE-532: Insertion of Sensitive Information into Log File].

Critical Impact

Exposure of the TEI api_key in logs allows an attacker with log access to authenticate as a legitimate client and consume embedding and rerank services.

Affected Products

• Hugging Face Text Embeddings Inference versions up to and including 1.9.4
• Deployments that configure the --api-key flag or API_KEY environment variable
• Container and orchestrated environments forwarding stdout or OTLP traces to centralized logging

Discovery Timeline

• 2026-10-11 - CVE-2026-108857 published to the National Vulnerability Database
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108857

Vulnerability Analysis

Text Embeddings Inference is a Rust-based serving stack for embedding and reranker models. The router component parses runtime configuration into an Args struct using clap. Fields holding sensitive values are expected to carry a redact attribute so their contents are masked when the struct is serialized or printed. The api_key field was defined without this attribute. On service startup, the router logs the parsed configuration, placing the Bearer token into plaintext process output. The same output is captured by container runtimes, forwarded to log aggregators, and emitted through OTLP exporters when tracing is enabled. See the VulnCheck Security Advisory and the referenced router source lines for the specific declaration.

Root Cause

The root cause is a missing field-level redaction annotation in the router's argument-parsing structure. Because the api_key field is treated like any other string, the Debug formatter and structured logging layers write its literal value. A sample startup log containing the exposed token is reproduced in the Hugging Face Startup Log writeup.

Attack Vector

An attacker needs read access to any sink that captures the router's standard output or OTLP traces. Common sources include Kubernetes pod logs, Docker container output, journald, and SIEM pipelines. Once the Bearer token is recovered, the attacker calls the TEI HTTP API with an Authorization: Bearer <token> header and issues embedding or rerank requests against protected endpoints. The attack is local in CVSS terms because log access is typically required rather than direct network interaction with the TEI service.

The vulnerability requires no exploit code. An attacker greps logs for the api_key configuration line and reuses the string against the service's REST interface. See the Hugging Face project repository for API usage.

Detection Methods for CVE-2026-108857

Indicators of Compromise

• Startup log lines from the TEI router that include an api_key field with a non-empty value
• OTLP span attributes referencing the router Args struct containing credential material
• Unexpected HTTP requests to /embed or /rerank from source addresses outside the approved client set
• Reuse of the same Bearer token from multiple distinct source IPs within a short interval

Detection Strategies

• Grep container and pod logs for the string api_key co-located with TEI service identifiers
• Parse OTLP exports and SIEM-ingested traces for span attributes carrying authentication tokens
• Correlate successful /embed and /rerank authorization events with the set of approved client identities

Monitoring Recommendations

• Alert on any log event where the TEI process emits its parsed configuration to stdout
• Monitor egress from log aggregation tiers to detect bulk extraction of historical log data
• Track the first observation of each client IP presenting the TEI Bearer token and alert on new entries

How to Mitigate CVE-2026-108857

Immediate Actions Required

• Rotate the TEI api_key on every deployment that ran version 1.9.4 or earlier with logging enabled
• Purge historical logs, container output archives, and OTLP trace stores that captured the plaintext key
• Restrict network access to TEI endpoints to known client subnets while rotation completes
• Audit log aggregation platforms for user accounts that accessed TEI-related indices

Patch Information

No fixed version is listed in the NVD entry at publication. Monitor the Hugging Face Text Embeddings Inference repository for a release that adds a redact attribute to the api_key field in router/src/main.rs. Review the VulnCheck Security Advisory for updated remediation guidance.

Workarounds

• Disable verbose startup logging or redirect the router's stdout to a sink with strict access controls
• Disable OTLP export, or filter spans to drop attributes containing credential fields before transmission
• Front TEI with a reverse proxy that performs authentication, allowing the backend to run without --api-key
• Replace static Bearer tokens with short-lived credentials injected per request by an upstream gateway

# Configuration example: restrict TEI log exposure and rotate the key
# 1. Rotate the API key and store it in a secret manager
kubectl create secret generic tei-api-key \
  --from-literal=API_KEY="$(openssl rand -hex 32)" \
  --dry-run=client -o yaml | kubectl apply -f -

# 2. Disable OTLP export until a patched release is deployed
unset OTEL_EXPORTER_OTLP_ENDPOINT

# 3. Restrict log read access on the TEI namespace
kubectl auth can-i get pods/log -n tei --as=system:serviceaccount:logging:fluentd