CVE-2026-108858

Predibase LoRAX versions up to and including 0.12.1 are vulnerable to a sensitive information exposure issue. The application improperly records the caller-supplied api_token from POST /generate request bodies into the router logs. This occurs because the GenerateParameters span field is instrume...

CVE-2026-108858 Predibase LoRAX through 0.12.1 API Token Exposure via Router Logs

Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied apitoken from POST /generate request bodies into router logs. Attackers with access to router logs or OTLP trace backends can recover other users' private-adapter tokens recorded...