https://pwn.watch/t/hugging-face Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 31 May 2024 00:00:00 GMT https://pwn.watch/i/hugging-face-spaces-secrets-leak https://pwn.watch/i/hugging-face-spaces-secrets-leak Fri, 31 May 2024 00:00:00 GMT high <p>Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2024-05-31: Hugging Face discloses unauthorized access to Spaces secrets and revokes tokens (<a href="https://huggingface.co/blog/space-secrets-disclosure">source</a>)</li></ul>