Description
Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate request bodies into router logs. Attackers with access to router logs or OTLP trace backends can recover other users' private-adapter tokens recorded through the instrumented GenerateParameters span field.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Predibase LoRAX
Default version status: unaffected
0 to ≤ 0.12.1affected
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/predibase-lorax-generate-api-token-logging ↗
- https://github.com/predibase/lorax/blob/c0e5798318a6b826572c612ddd4cf44621aa4add/router/src/server.rs#L584-L596 ↗
- https://github.com/predibase/lorax/blob/c0e5798318a6b826572c612ddd4cf44621aa4add/router/src/lib.rs#L182-L188 ↗
- https://github.com/predibase/lorax ↗
- https://www.vulncheck.com/advisories/predibase-lorax-through-0.12.1-api-token-exposure-via-router-logs ↗
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-108858-predibase-lorax-generate-api-token-logging ↗