A client configured for an independent Hub-compatible service should send its API calls and token to the selected endpoint. The Hugging Face Hub 2.3.0 changelog identifies 20 webhooks, access request and user or organization methods that instead called huggingface.co with the configured instance token. The release fixes the routing; the environment-variable…
Inspect the ClaimsCase · DiggingBeagle record
Hugging Face SDK sent custom-Hub API calls to the default public endpoint
The v2.3.0 release fixes 20 methods that ignored HfApi(endpoint=...) and contacted huggingface.co with the configured instance token; behavior using HF_ENDPOINT was not affected.
Scope
huggingface_hub versions prior to v2.3.0 using HfApi(endpoint=...) in affected methods; credential routing and service neutrality.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
CASE-2026-HF-HUB-CUSTOM-ENDPOINT-TOKEN: 20 affected methods; benchmark of 798,924 files improved from 776s to 19.7s in a separate feature. Evidence comes from SRC-2026-HF-HUB-230-RELEASE. Published technical statements or controlled results are not verified production-loss counts. No impact band is assigned because the observed outcome and its denominator do not establish a comparable severity measure.
Assessed Oct 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-HF-HUB-01 · Hugging Face Hub SDK v2.3.0 release notes
At a glance
An endpoint selection defect undermines the assumption that independent Hub-compatible deployments receive only their own secrets. It is a concrete interoperability and credential-boundary bug, not proof that repositories became exportable or that data was exfiltrated by an attacker.
Read the implicationsWhether any custom-instance credentials reached an unauthorized recipient or were accepted at another endpoint is not established.
Limits and uncertaintyFull account
A client configured for an independent Hub-compatible service should send its API calls and token to the selected endpoint. The Hugging Face Hub 2.3.0 changelog identifies 20 webhooks, access request and user or organization methods that instead called huggingface.co with the configured instance token. The release fixes the routing; the environment-variable HF_ENDPOINT configuration was not affected, so the bug is narrower than a universal leak of third-party Hub tokens. The maintainer release note documents potentially inappropriate token delivery, not independently measured abuse or an adversary extracting credentials. The same release accelerates large recursive listings from 776 seconds to 19.7 seconds in a specific 798,924-file benchmark; that is useful portability context, not evidence that token exposure has been exploited.
The affected configuration was HfApi(endpoint=...), which explicitly redirects operations to a Hub-compatible instance. The v2.3.0 release notes identify 20 methods that ignored that instance and contacted the public Hub with its token; they also state that configurations using HF_ENDPOINT were not affected by this particular routing defect. The appropriate impact unit is thus the affected method and configuration, not every Hugging Face access token or every private Hub installation. The release report does not establish that a third party redeemed a transmitted token. Versioned changelog.
Mechanism and trust boundary
- 01
Configure an independent Hub API endpoint
An HfApi client receives an explicit endpoint together with a token intended for the selected compatible service.
Boundary: Independent Hub tenant / client configuration
- 02
Invoke one of twenty affected methods
Certain webhook, access request and user/organization API methods ignored the instance endpoint and directed requests to huggingface.co.
Boundary: Client method routing / global Hugging Face domain
- 03
Expose the selected endpoint token to the wrong service
The original client may attach the independent service token to a call addressed to Hugging Face; that is a credential-routing defect, not proof that Hugging Face abused the token.
Boundary: Instance-scoped token / unrelated service recipient
Timeline
- Oct 22, 2026Event type unspecified
SDK release 2.3.0
The endpoint-routing fix and independent filesystem-listing optimizations shipped in the same SDK release.
- Oct 22, 2026disclosure
Public disclosure
Claims & evidence
CLM-HF-HUB-01Hugging Face listed 20 API methods that ignored the explicit HfApi custom endpoint, instead sending requests to huggingface.co with the instance token.supported
Basis: reported finding
- supportsHugging Face Hub SDK v2.3.0 release notespatch commit artifact
Bug and typo fixes: Respect custom endpoint in webhooks, access requests and user APIs
CLM-HF-ENRICH-PERFIn a vendor benchmark, HfFileSystem find() enumerated 798,924 files in 19.7 seconds versus 776 seconds before the parallel traversal change; this measures listing performance, not security remediation.supported
Basis: reported finding
- supportsHugging Face Hub SDK v2.3.0 release notespatch commit artifact
Parallel recursive listings benchmark: datasets/allenai/objaverse
CLM-HF-ENRICH-CONFIGThe v2.3.0 release notes identify 20 HfApi methods that sent requests to huggingface.co using a token configured for a custom HfApi(endpoint=...) instance; HF_ENDPOINT configurations did not have that defect.supported
Basis: reported finding
- supportsHugging Face Hub SDK v2.3.0 release notespatch commit artifact
Bug and typo fixes: Respect custom endpoint in webhooks, access requests and user APIs
Implications
An endpoint selection defect undermines the assumption that independent Hub-compatible deployments receive only their own secrets. It is a concrete interoperability and credential-boundary bug, not proof that repositories became exportable or that data was exfiltrated by an attacker.
Controls and mitigations
- Upgrade huggingface_hub to at least 2.3.0, audit calls made using explicit HfApi(endpoint=...), and rotate any custom-instance token when external exposure is possible. The release notes state HF_ENDPOINT setups were not affected by this exact routing bug.
Unknowns and contradictions
- Whether any custom-instance credentials reached an unauthorized recipient or were accepted at another endpoint is not established.
Sources and citation
Material revision history
- Oct 24, 2026 · Canonical change recorded · new in release · revision 188