ClosedHighNo fix needed
Hugging Face Spaces secrets accessed without authorization
Hugging Face Spaces
Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.
Why this severity: Platform secrets exposure
- Started
- May 31, 2024
- Closed
- May 31, 2024
Affected
Not published yet
Fixed in
No fixed release yet
Timeline1
Hugging Face discloses unauthorized access to Spaces secrets and revokes tokens
Source
Advisories1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
