Description
Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate request bodies into router logs. Attackers with access to router logs or OTLP trace backends can recover other users' private-adapter tokens recorded through the instrumented GenerateParameters span field.
Published: 2026-10-11
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive information exposure (API token leakage)
Action: Apply Patch
AI Analysis

Impact

Predibase LoRAX versions through 0.12.1 log the api_token supplied in POST /generate calls into router logs, enabling attackers with access to those logs or OTLP trace backends to recover other users’ private‑adapter tokens. This results in accidental exposure of sensitive authentication tokens, compromising confidentiality.

Affected Systems

The vulnerability affects the Predibase LoRAX software. All releases up to and including version 0.12.1 are affected.

Risk and Exploitability

The CVSS score of 6.8 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Attackers who can read router logs or OTLP traces can exploit the exposure, but no additional conditions such as privilege escalation or remote code execution are required. The risk is primarily in the confidentiality domain and is limited to environments where log or trace data is accessible by unauthorized users.

Generated by OpenCVE AI on October 12, 2026 at 01:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest LoRAX release that removes or sanitizes api_token logging.
  • If an upgrade is not immediately possible, modify the router configuration or source to eliminate logging of api_token or to redact the field before writing logs.
  • Restrict access to router logs and OTLP trace backends so that only authorized personnel or systems can view them.

Generated by OpenCVE AI on October 12, 2026 at 01:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
References

Tue, 13 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Predibase
Predibase lorax
Vendors & Products Predibase
Predibase lorax

Mon, 12 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-538
References
Metrics threat_severity

None

 threat_severity

Moderate

Sun, 11 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate request bodies into router logs. Attackers with access to router logs or OTLP trace backends can recover other users' private-adapter tokens recorded through the instrumented GenerateParameters span field.
Title Predibase LoRAX through 0.12.1 API Token Exposure via Router Logs
Weaknesses CWE-532
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Predibase Lorax
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T19:41:34.574Z

Reserved: 2026-10-11T13:06:48.900Z

Link: CVE-2026-108858

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-11T14:17:05.640

Modified: 2026-10-16T19:18:44.867

Link: CVE-2026-108858

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-11T13:26:05Z

Links: CVE-2026-108858 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:57:28Z

Weaknesses
  • CWE-532

    Insertion of Sensitive Information into Log File

  • CWE-538

    Insertion of Sensitive Information into Externally-Accessible File or Directory