EUVD-2026-97008

Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured apikey because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OTLP telemetry can recover the Bearer tok...

CVE-2026-108857

Hugging Face Text Embeddings Inference versions through 1.9.4 are vulnerable to a cleartext logging flaw. The root cause is the absence of a redact attribute for the api_key within the router's Args struct . This oversight allows the configured api_key to be exposed in router logs, container outp...