CVE-2026-59806: Gradio SSRF & Open Redirect – Credential Theft via File Endpoint

Technical summary

The vulnerability exists in Gradio's file_fetch() function, which processes HTTP/HTTPS URLs supplied via the /gradio_api/file= endpoint without adequate validation. This enables two attack classes: (1) Open Redirect (CWE-601) via unsanitized URL redirection, and (2) Server-Side Request Forgery (CWE-918) where the server performs requests on behalf of an attacker, potentially accessing internal metadata endpoints. In cloud environments, this can be exploited to retrieve instance credentials, IAM tokens, and other sensitive metadata that would otherwise be restricted to the instance itself. The vulnerability is accessible to unauthenticated users.

Business impact

Organizations using Gradio in cloud environments face significant risk of credential compromise. EC2 IAM role credentials extracted via SSRF could grant attackers persistent access to AWS resources, databases, or storage buckets. Even in non-cloud deployments, the open redirect component can be weaponized in phishing campaigns or to distribute malware. The user-interaction requirement (clicking a malicious link) may seem limiting, but in social engineering or internal network contexts, this is readily exploitable. The high CVSS score (7.4) reflects the confidentiality impact of exposed credentials against the user-interaction constraint.

Affected systems

All Gradio installations prior to version 6.20.0 are affected. The vulnerability is present in the file handling logic and affects both public and internally-facing Gradio deployments. Cloud-hosted instances (AWS, GCP, Azure) and on-premises installations where metadata services are accessible are at elevated risk. The vendor_products field indicates this is a primary concern for Gradio's core library rather than a narrow feature subset.

Exploitability

Exploitation requires crafting a URL (or FileData response) pointing to a target—cloud metadata endpoints (169.254.169.254), internal services, or arbitrary external sites. The attacker must then deliver this link to a user who clicks it. While this requires user interaction, it is not a high barrier in scenarios involving social engineering, internal employees, or embedded links in collaborative documents. Once clicked, the server-side forgery component executes automatically without further user involvement, retrieving and potentially exposing sensitive data. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) reflects network accessibility, low complexity, and high confidentiality impact.

Remediation

Upgrade Gradio to version 6.20.0 or later immediately. This version includes input validation and sanitization for URLs supplied to file_fetch(), preventing both open redirect and SSRF attacks. Organizations should verify the upgrade is complete and test Gradio endpoints post-deployment. If immediate patching is not feasible, implement network-level mitigations: restrict Gradio server outbound access to only required destinations, use security groups or firewall rules to block access to cloud metadata endpoints (169.254.169.254), and disable or isolate Gradio instances from internal networks if possible. Monitor access logs for suspicious requests to /gradio_api/file= with unusual URL parameters.

Patch guidance

Update Gradio to version 6.20.0 or later. Verify the patch by checking the installed version (pip show gradio or equivalent) and reviewing release notes from the official Gradio repository to confirm the fix addresses CWE-601 and CWE-918. If you are unable to patch immediately, document the delay and apply compensating controls (network isolation, metadata endpoint blocking). Test the patched version in a staging environment to ensure compatibility with existing workflows before rolling out to production.

Detection guidance

Monitor HTTP access logs for requests to /gradio_api/file= that contain suspicious URL parameters, particularly those referencing: cloud metadata endpoints (169.254.169.254, similar GCP/Azure endpoints), internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.1), or known-malicious external domains. Implement URL filtering at the Gradio application level or upstream proxy to block metadata service access. Set up alerts for multiple failed or suspicious file-fetch requests from the same source or with similar payload patterns. Review web application firewall (WAF) rules to detect URL-encoded or obfuscated references to internal services. If possible, enable Gradio debug logging to capture file_fetch() parameters and review them for anomalies.

Why prioritize this

This vulnerability merits immediate remediation priority due to the potential for credential theft in cloud environments, the widespread use of Gradio in ML/AI workflows, and the ease of crafting a malicious payload. Although user interaction is required, the combination of high confidentiality impact (CVSS 7.4 HIGH) and the realistic threat of social engineering makes it more urgent than vulnerabilities requiring local access or advanced exploitation. Organizations running Gradio on AWS, GCP, or Azure should treat this as critical. Those in isolated or air-gapped networks face lower risk but should still patch during the next maintenance window.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) reflects: Network Accessibility (AV:N) – the endpoint is reachable remotely; Low Attack Complexity (AC:L) – crafting a malicious URL is trivial; No Privilege Required (PR:N) – anyone can invoke the endpoint; User Interaction Required (UI:R) – a user must click the link; Changed Scope (S:C) – impact extends beyond the vulnerable component (to cloud credentials or internal systems); High Confidentiality Impact (C:H) – sensitive data (IAM credentials) can be exposed; No Integrity or Availability impact (I:N/A:N). The user-interaction requirement prevents a higher score, but the confidentiality impact of credential exposure justifies the HIGH rating.

Frequently asked questions