CVE-2026-59806
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in Gradio before version 6.20.0 allows open redirect and server-side request forgery (SSRF) via unvalidated URLs in the file_fetch() function at the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response to access internal endpoints such as cloud metadata services to steal sensitive credentials, including EC2 IAM role credentials.
Risk Assessment
The risk includes the ability to redirect users to malicious sites and steal sensitive credentials from cloud services, potentially leading to unauthorized access to the organization's cloud resources.
Recommendation
It is recommended to immediately upgrade Gradio to version 6.20.0 or later, which includes a fix that eliminates the open redirect and SSRF vulnerability.
Other vulnerabilities in Gradio
See all- CVE-2026-49119High
A path traversal vulnerability in the FileExplorer component of Gradio before version 6.16.0 allows unauthenticated attackers to read files outside the configured root directory. Attackers can use traversal sequences or absolute paths that cause os.path.join to discard the root_dir prefix.
- CVE-2026-10783Low
A security flaw in gradio-app gradio 6.14.0 affects the save_audio_to_cache function of the Audio Cache Key Handler component. Manipulation leads to use of weak hash. The attack requires local access, is difficult to exploit, but the exploit is publicly available.
- CVE-2026-48545Medium
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the reverse proxy endpoint. Attackers controlling any HF Space can return a parent-domain cookie that the shared client stores and automatically replays into all subsequent proxy requests to other legitimate Spaces, affecting all users of the same Gradio deployment.
- CVE-2023-34239High
Gradio is an open-source Python library used to build machine learning and data science applications. Due to a lack of path filtering, Gradio does not properly restrict file access to users and does not properly restrict what URLs are proxied. These issues have been addressed in version 3.34.0.
Original NVD description (English source)
Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perform client-side SSRF by supplying unvalidated HTTP/HTTPS URLs to the file_fetch() function in the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response targeting internal endpoints such as cloud metadata services to retrieve sensitive credentials including EC2 IAM role credentials.