# Hugging Face Spaces secrets accessed without authorization · pwn.watch

> Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.

Page: https://pwn.watch/i/hugging-face-spaces-secrets-leak · generated 2026-10-22T21:47:37.879Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Hugging Face Spaces
- Started: 2024-05-31 · closed: 2024-05-31

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/hugging-face-spaces-secrets-leak/feed.xml
- JSON Feed: https://pwn.watch/i/hugging-face-spaces-secrets-leak/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/hugging-face-spaces-secrets-leak.json
- This file: https://pwn.watch/i/hugging-face-spaces-secrets-leak/llms.txt

## Updates (newest first)
- 2024-05-31: Hugging Face discloses unauthorized access to Spaces secrets and revokes tokens (https://huggingface.co/blog/space-secrets-disclosure)

## Fix brief
# Security brief: Hugging Face Spaces secrets accessed without authorization

Source: https://pwn.watch/i/hugging-face-spaces-secrets-leak · status: closed (closed May 31, 2024) · severity: high · updated May 31, 2024

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.

Severity detail: Platform secrets exposure

- Product: Hugging Face Spaces

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- May 31, 2024: Hugging Face discloses unauthorized access to Spaces secrets and revokes tokens

## Advisories
- [Space secrets leak disclosure](https://huggingface.co/blog/space-secrets-disclosure) (Hugging Face)

---
Machine-readable: https://pwn.watch/i/hugging-face-spaces-secrets-leak.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.