Gradio CVE-2026-48545

Exploitation requires a multi-tenant Gradio deployment (e.g., Hugging Face Spaces) running a version below 6.15.0 where multiple users share one Gradio process and its module-level httpx.AsyncClient, AND active use of the /proxy= reverse-proxy endpoint that reaches sibling *.hf.space hosts. The attacker must control at least one upstream Space able to return a parent-domain Set-Cookie header. Per CVSS, the attacker is unauthenticated (PR:N) and network-based (AV:N), but exploitation is gated by passive user interaction (UI:P - a victim must trigger the proxied request) and high attack complexity (AC:H - timing/state of the shared cookie jar). Limiting factors: single-tenant or non-proxy Gradio installs are not meaningfully exposed; the bug does not yield code execution or denial of service (VA:N, no subsequent-system impact); and SSVC Automatable:no indicates it is not amenable to reliable large-scale automation.

The CVSS 4.0 base score is 7.6 with vector AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N: network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H) and required passive user interaction (UI:P), and high confidentiality and integrity impact with no availability or subsequent-system impact. SSVC aligns with this nuanced picture: exploitation is rated poc (proof-of-concept, not active), Automatable is no (so not suited to mass/wormable abuse), and Technical Impact is total. The signals are internally consistent - this is a genuine multi-tenant integrity/confidentiality risk on shared Gradio/HF Space hosting rather than a trivially mass-exploitable bug, and the AC:H/UI:P/Automatable:no factors argue against opportunistic scanning. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here; absence of a CISA KEV entry indicates no confirmed in-the-wild use. Net: a real priority for multi-tenant Gradio/HF deployments, but the bounded impact (no RCE, no availability/subsequent impact) and high complexity place it below drop-everything severity for single-tenant installs.

An attacker stands up a malicious Hugging Face Space whose responses include a Set-Cookie header scoped to the shared parent domain. When a victim's interaction causes the vulnerable Gradio /proxy= endpoint to fetch the attacker's Space, the shared httpx client stores that cookie and replays it on later proxied requests to legitimate sibling Spaces, fixing the victim's session under an attacker-known value. SSVC marks exploitation as proof-of-concept, so working demonstration code is indicated; the AC:H and UI:P CVSS metrics mean the attacker must induce the right proxy interaction rather than fire-and-forget.