CVE-2026-108857

Hugging Face Text Embeddings Inference versions through 1.9.4 are vulnerable to a cleartext logging flaw. The root cause is the absence of a redact attribute for the api_key within the router's Args struct . This oversight allows the configured api_key to be exposed in router logs, container outp...