Authentication Bypass in Hugging Face Hub Private Inference Endpoints via Cache Poisoning
Overview
A critical vulnerability was discovered in the Hugging Face Hub's private Inference Endpoint service, allowing unauthenticated attackers to gain access to and execute inference against otherwise protected models. The attack vector involves a sophisticated cache poisoning technique targeting the service's API gateway and load balancer. By crafting a specific set of HTTP headers in a request to a public model's endpoint, an attacker could poison a shared cache entry. Subsequent requests from legitimate users to their private endpoints, if routed through the same cache node, would incorrectly use the poisoned authentication context, granting the attacker's session temporary access to the private model. The impact is severe, enabling unauthorized inference, potential model theft through systematic querying, and the ability to probe for other vulnerabilities within the private model's logic. Researchers at AI Sentinel Labs demonstrated the attack by successfully querying a private financial forecasting model and exfiltrating sensitive inference results. The vulnerability stemmed from an improper cache key generation logic that failed to include the full user authentication token, relying instead on less specific identifiers that could be manipulated. Hugging Face responded quickly by deploying a global cache flush and patching the key generation algorithm to include user-specific cryptographic nonces.
Affected Systems
Testing Guide
1. This vulnerability was patched server-side by Hugging Face, so direct testing of the exploit is no longer possible against their infrastructure. 2. Review your access logs for the period between June and July 2026 for any successful inference requests to your private endpoints from unauthorized or unrecognized sources. 3. Verify that your API tokens for the service have been rotated since the patch was announced. 4. Attempt to access your private endpoint using an expired or invalid authentication token. The request should be definitively rejected with a `401 Unauthorized` or `403 Forbidden` error.
Mitigation Steps
1. This was a server-side vulnerability. Hugging Face has confirmed the issue is patched globally across all their infrastructure as of 2026-07-11. 2. As a best practice, rotate any API keys or access tokens that were used with the Inference Endpoint service prior to the patch date. 3. Implement robust monitoring and logging for your private endpoints to detect anomalous inference patterns or access from unexpected IP ranges. 4. For highly sensitive models, consider hosting them in a fully air-gapped or VPC-only environment if your cloud provider supports it, rather than relying solely on the platform's authentication.
Patch Details
A server-side patch was globally deployed by the Hugging Face security team on 2026-07-11. No user action is required to receive the patch.