The report
A user of an independent Hub-compatible service can set HfApi(endpoint=...) and reasonably expect every method to target that endpoint. The Hugging Face Hub v2.3.0 changelog identifies 20 methods that instead contacted huggingface.co, potentially carrying the configured instance's token. The separate HF_ENDPOINT environment-variable mechanism was not affected. The fix is a security and interoperability correction, not proof that third-party tokens were maliciously used.
The SDK release also parallelizes recursive listings. Hugging Face reports that one dataset of about 799,000 files took 19.7 seconds to enumerate, down from 776 seconds in its published comparison. That improves a practical step in inspecting or replicating large repositories, but does not grant export rights or alter hosting governance. SDK release.
Which custom endpoint setting was affected
The v2.3.0 fix targets calls made through explicit HfApi(endpoint=...), for twenty methods covering webhooks, access requests and user or organization information. The release notes explicitly exempt clients configured only with HF_ENDPOINT, which prevents an overly broad claim that every independent Hub token was misrouted. In the listing benchmark the roughly 798,924-file repository used 801 requests and 776 seconds before the change versus 807 requests and 19.7 seconds after it. The faster run used slightly more network requests; the gain reflects concurrency and directory partitioning, not the creation of a new right to replicate protected datasets. Release and benchmark.
A precise configuration boundary, not a general Hub leak
The release notes narrow the routing defect to 20 HfApi(endpoint=...) methods, including webhook, access-request and organization APIs. Configurations relying on HF_ENDPOINT were not affected by this particular issue. The presence of an instance token in a wrongly directed request establishes a potential credential-exposure path, not confirmed credential theft. The separate recursive listing speedup is a vendor benchmark on a very large repository; the two changes share a release but have different security implications. v2.3.0 release details; canonical endpoint case.