Hugging Face cross-tenant access (Research)

Wiz Research identified critical misconfigurations in Hugging Face’s shared inference, CI/CD, and container registry infrastructure that allowed proof-of-concept remote code execution via specially crafted pickle model files and Dockerfiles, retrieval of IMDS credentials, lateral movement across EKS misconfigurations, and push/pull access to a centralized container registry — together creating a realistic risk of cross-tenant data access and supply-chain attacks.