CVE-2026-108858: Insertion of Sensitive Information into Log File in Predibase LoRAX

CVE-2026-108858 describes a sensitive information exposure vulnerability in Predibase LoRAX through version 0.12.1. The issue arises because the api_token supplied by callers in POST /generate request bodies is written into router logs, specifically within the instrumented GenerateParameters span field. An attacker with access to router logs or OTLP trace backends can extract other users' private adapter tokens from these logs. This vulnerability has a CVSS 4.0 base score of 6.8, indicating a medium severity risk. There is no information about an available patch or vendor advisory specifying remediation.

The vulnerability allows an attacker with access to router logs or OTLP trace backends to obtain sensitive api_tokens belonging to other users. This exposure can lead to unauthorized use of private adapter tokens, potentially compromising user accounts or services relying on these tokens. There is no indication of privilege escalation or direct remote exploitation without log access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to router logs and OTLP trace backends to trusted personnel only to prevent unauthorized token disclosure.