Predibase LoRAX vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Predibase LoRAX: 1 record(s), with affected versions and fixes.

CVE-2026-108858 Medium · 5.5 CWE-532 Oct 11, 2026

Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that...

Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate request bodies into router logs. Attackers with access to router logs or OTLP trace backends can recover other users' private-adapter tokens recorded through the instrumented GenerateParameters span field.