Hugging Face Spaces secrets accessed without authorization
Teaser from the source
Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.
This is the RSS-feed teaser. Read the full article at the original source.
Read at pwn.watchMore on authorization
Other advisories
- HighCVE-2026-111493Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifier…
- MediumCVE-2026-115298Incorrect Authorization in Elasticsearch Leading to Information Disclosure
- Not rateddla:DLA-4885-1Debian LTS trapperkeeper-authorization-clojure: security update
- MediumCVE-2026-20241Cisco Identity Services Engine Authorization Bypass Vulnerability
- MediumCVE-2026-99225keys: Check the authorization payload in process keyring searches
- Not rateddsa:DSA-6609-1Debian trapperkeeper-authorization-clojure: security update
- Not ratedosv:CVE-2026-121585InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
- Not ratedosv:CVE-2026-121582Umami Record API Endpoint route.ts authorization
Other news entries
- Cisco Identity Services Engine Authorization Bypass VulnerabilityNewsCisco PSIRT
- Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated CriticalNewsSecurityWeek
- Barracuda’s security appliances have a security problem of their ownNewsCSO Online
- Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root AccessNewsThe Hacker News
- b14g: about 97M CORE drained from its Core staking contracts; contracts pausedBreachpwn.watch
- Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass FlawNewsThe Hacker News
- Chainalysis breach: all-customer password hashes and live tokens exposed; KYT restore phased, Nubank pauses direct crypto transfersBreachpwn.watch
- Adobe, Veeam, Juniper Networks Patch Critical VulnerabilitiesNewsSecurityWeek
Source: https://pwn.watch/i/hugging-face-spaces-secrets-leak
ID