EUVD-2026-42376
GHSA-rj25-5m4j-hcxq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no privileges; user interaction required (browser redirect); scope change to subsequent cloud system with high confidentiality loss via IAM credentials and low integrity via open redirect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perform client-side SSRF by supplying unvalidated HTTP/HTTPS URLs to the file_fetch() function in the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response targeting internal endpoints such as cloud metadata services to retrieve sensitive credentials including EC2 IAM role credentials.
AnalysisAI
Open redirect and client-side SSRF in Gradio before 6.20.0 expose cloud infrastructure credentials to network attackers via the /gradio_api/file= endpoint. The file_fetch() function accepts unvalidated HTTP/HTTPS URLs from attacker-controlled FileData responses, enabling redirection of victim browsers to arbitrary destinations including cloud metadata services such as the EC2 instance metadata endpoint (169.254.169.254). Successful exploitation in cloud-hosted Gradio deployments allows retrieval of IAM role credentials, achieving high subsequent-system confidentiality impact. No public exploit or CISA KEV listing is identified at time of analysis; a fix is available in version 6.20.0.
Technical ContextAI
Gradio is a Python framework widely used in the AI/ML ecosystem to build and share interactive ML model demos, predominantly deployed on cloud platforms (Hugging Face Spaces, AWS, GCP). The vulnerability (CWE-601: URL Redirection to Untrusted Site) resides in the file_fetch() function exposed at the /gradio_api/file= endpoint. When Gradio processes a FileData object whose url field is attacker-controlled, it forwards the unvalidated URL directly to the client browser without allowlist validation or scheme restriction. This permits two attack classes: (1) open redirect - victim browser is sent to an arbitrary external site, enabling phishing; (2) client-side SSRF - victim browser is directed to internal network resources such as the AWS EC2 instance metadata service (http://169.254.169.254/latest/meta-data/iam/security-credentials/), leaking temporary IAM role credentials. The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:P reflects network-reachable exploitation with passive user interaction and a specific attack requirement, while subsequent-system confidentiality (SC:H) captures the IAM credential exposure rather than the Gradio host itself.
RemediationAI
The primary fix is to upgrade Gradio to version 6.20.0 or later, which introduces validation of URLs supplied to file_fetch() to block unvalidated HTTP/HTTPS redirects. The patched release is confirmed at https://github.com/gradio-app/gradio/releases/tag/gradio%406.20.0. For deployments that cannot immediately upgrade, a concrete compensating control is to restrict network egress from client browsers to link-local ranges (169.254.0.0/16) at the WAF or network layer, preventing cloud metadata access - note this does not mitigate the open redirect path. Additionally, placing Gradio behind an authenticated reverse proxy (requiring login before reaching /gradio_api/file=) eliminates unauthenticated exploitation of the SSRF path, at the cost of restricting public demo access. Cloud deployments should audit IAM roles attached to instances running Gradio and apply least-privilege policies to limit the impact of any credential exposure.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today