CVE-2026-28416

An attacker can exploit this SSRF vulnerability by hosting a malicious Gradio Space and enticing a victim to load it using gr.load(). The malicious Space contains a proxy_url which, if trusted, is added to the allowlist. This allows the attacker to leverage the victim's server to make requests to internal services, cloud metadata endpoints (e.g., AWS instance details), and even private networks. The potential impact includes unauthorized access to sensitive data, credential theft, and potentially even lateral movement within the victim's infrastructure. This vulnerability is particularly concerning for organizations deploying Gradio Spaces in production environments, especially those with access to sensitive internal resources.

Organizations and developers using Gradio for prototyping machine learning applications, particularly those deploying Spaces publicly or integrating with internal services, are at risk. Shared hosting environments where multiple users can deploy Gradio Spaces are also vulnerable, as a malicious Space could impact other users on the same server.

• python / gradio:

import subprocess
subprocess.run(['pip', 'show', 'gradio'], check=True)

• python / gradio: Check Gradio version in requirements.txt or setup.py files. • generic web: Monitor outbound HTTP requests from Gradio applications for unexpected destinations, especially internal network addresses or cloud metadata endpoints. • generic web: Review Gradio application logs for unusual HTTP requests or errors related to proxy URLs.

1. 2026-03-01Disclosure

   disclosure

1. Reserviert2026-02-27
2. Veröffentlicht2026-03-01
3. Geändert2026-03-04
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-28416 is to upgrade Gradio to version 6.6.0 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter outbound HTTP requests and block suspicious URLs. Carefully review and restrict the proxy_url allowlist in your Gradio configuration, ensuring that only trusted domains are permitted. Additionally, implement strict input validation on any data used in gr.load() to prevent malicious Space loading. After upgrading, confirm the fix by attempting to load a known malicious Gradio Space and verifying that the proxy URL is not accepted.