CVE-2026-108858

Predibase LoRAX versions up to and including 0.12.1 are vulnerable to a sensitive information exposure issue. The application improperly records the caller-supplied api_token from POST /generate request bodies into the router logs. This occurs because the GenerateParameters span field is instrume...