Hugging Face Spaces secrets accessed without authorization
Teaser from the source
Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.
This is the RSS-feed teaser. Read the full article at the original source.
Read at pwn.watchMore on authorization
Other advisories
- MediumCVE-2026-20241Cisco Identity Services Engine Authorization Bypass Vulnerability
- Not rateddsa:DSA-6609-1Debian trapperkeeper-authorization-clojure: security update
- Not ratedosv:CVE-2026-121585InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
- Not ratedosv:CVE-2026-121582Umami Record API Endpoint route.ts authorization
- Not ratedosv:CVE-2026-121736NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation
- Not ratedosv:CVE-2026-121732RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment
- Not ratedosv:CVE-2026-121730emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint
- Not ratedosv:CVE-2026-121729emailflare before commit cf31f33 Missing Authorization via /api/keys Routes
Other news entries
- Cisco Identity Services Engine Authorization Bypass VulnerabilityNewsCisco PSIRT
- Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated CriticalNewsSecurityWeek
- Barracuda’s security appliances have a security problem of their ownNewsCSO Online
- Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root AccessNewsThe Hacker News
- b14g: about 97M CORE drained from its Core staking contracts; contracts pausedBreachpwn.watch
- Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass FlawNewsThe Hacker News
- Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesNewsSecurityWeek
- Binance says a fake job interview started its $6.3B hack; it has rebuilt the affected wallet system and will cover all lossesBreachpwn.watch
Source: https://pwn.watch/i/hugging-face-spaces-secrets-leak
ID