CVE-2026-28416 PUBLISHED

Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing

Assigner: GitHub_M
Reserved: 27.02.2026 Published: 27.02.2026 Updated: 27.02.2026

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses gr.load() to load an attacker-controlled Space, the malicious proxy_url from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endpoints, and private networks through the victim's infrastructure. Version 6.6.0 fixes the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS Score: 8.2

Product Status

Vendor gradio-app
Product gradio
Versions
  • Version < 6.6.0 is affected

References

Problem Types

  • CWE-918: Server-Side Request Forgery (SSRF) CWE