CVE-2026-108858 Details
Description
Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate request bodies into router logs. Attackers with access to router logs or OTLP trace backends can recover other users' private-adapter tokens recorded through the instrumented GenerateParameters span field.
A vulnerability in Predibase LoRAX versions through 0.12.1 allows for the exposure of sensitive information. The issue arises because the application logs the caller-supplied 'api_token' from POST '/generate' request bodies into the router logs. This vulnerability can be exploited by attackers with access to the router logs or OTLP trace backends, who can recover other users' private-adapter tokens that were recorded through the 'GenerateParameters' span field.
The vulnerability can be addressed by wrapping the 'api_token' field in a type that redacts its value when logged, such as a 'Secret<String>' type. Additionally, the 'generate' span field should be modified to exclude sensitive information before it is recorded.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Predibase LoRAX | <= 0.12.1 (semver) main |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |