CVE-2026-108858 Predibase CVE debrief

Who should care

LoRAX users and administrators should assess exposure and prioritize updates or mitigations. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Additionally, they should monitor for and respond to potential token exposure.

Why it matters

CVE-2026-108858 exposes sensitive information in Predibase LoRAX through 0.12.1, allowing potential unauthorized access to private-adapter tokens. LoRAX users and administrators should assess exposure, prioritize updates or mitigations, and monitor for potential token exposure.

• Potential unauthorized access to private-adapter tokens
• Possible lateral movement within affected systems
• Need for increased monitoring of router logs and OTLP trace backends
• Verification of LoRAX version and potential updates required

Technical summary

Predibase LoRAX through 0.12.1 writes caller-supplied api_token from POST /generate request bodies into router logs. Attackers with access to router logs or OTLP trace backends can recover other users' private-adapter tokens. The vulnerability is a sensitive information exposure that can lead to unauthorized access to private-adapter tokens. The affected product is Predibase LoRAX through 0.12.1. The vulnerability is caused by the writing of caller-supplied api_token from POST /generate request bodies into router logs.

Defensive priority

Medium priority for LoRAX users and administrators

Recommended defensive actions

• Review and update LoRAX to a version beyond 0.12.1 if available
• Restrict access to router logs and OTLP trace backends
• Monitor for and respond to potential token exposure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• technicalSummary

Evidence notes

The CVE record and NVD entry provide details on the sensitive information exposure vulnerability in Predibase LoRAX through 0.12.1. The vulnerability is caused by the writing of caller-supplied api_token from POST /generate request bodies into router logs. This allows attackers with access to router logs or OTLP trace backends to recover other users' private-adapter tokens. The CVE Program and NVD records are the primary sources of information for this vulnerability. The details are limited to publicly available information and may be

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.