Cleartext Storage of Sensitive Information Affecting github.com/kserve/kserve/pkg/credentials/hf package, versions <0.16.0-rc0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Cleartext Storage of Sensitive Information vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMKSERVEKSERVEPKGCREDENTIALSHF-14176142
- published4 Dec 2025
- disclosed2 Dec 2025
- creditUnknown
Introduced: 2 Dec 2025
New CVE NOT AVAILABLE CWE-312 Â (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/kserve/kserve/pkg/credentials/hf to version 0.16.0-rc0 or higher.
Overview
Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information due to the Hugging Face HF_TOKEN. Because the token is exposed directly in environment variables, any user or process with access to container metadata, logs, or runtime inspection tools can obtain the secret, allowing unauthorized access to protected Hugging Face resources.