CVE-2026-10783: 
Gradio vulnerability analysis and mitigation

CVE-2026-10783 is a weak hash vulnerability in the save_audio_to_cache() function (Audio Cache Key Handler) of gradio-app/gradio version 6.14.0. The function derives audio cache directory keys solely from raw audio byte data (data.tobytes()), ignoring metadata such as sample rate, format, dtype, and shape — allowing non-equivalent audio outputs to collide into the same cache namespace. It was disclosed on June 4, 2026, with a patch merged on May 26, 2026 via PR #13394. The vulnerability carries a CVSS v3.1 base score of 2.5 (Low) and a CVSS v4.0 base score of 1.1 (Low) (Github Advisory, Feedly).

The root cause is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-328 (Use of Weak Hash). In gradio/processing_utils.py, the save_audio_to_cache() function computes a cache directory path by hashing only data.tobytes() — the raw numpy array bytes — without incorporating audio metadata (sample rate, output format, dtype, or shape). As a result, two audio arrays with identical raw bytes but different sample rates or formats resolve to the same cache directory, potentially causing one audio output to be served in place of another. Exploitation requires local access with low privileges and is considered high complexity. A complete proof-of-concept Python script demonstrating the cache key collision is publicly available (GitHub Issue, GitHub PR).

A low-privileged local attacker can exploit this cache key collision to read cached audio data that belongs to a different audio output — specifically, audio files with identical raw bytes but different metadata (e.g., different sample rates or formats) may be incorrectly served from the same cache directory. The confidentiality impact is limited to cached audio data on the local system; there is no integrity or availability impact, no lateral movement potential, and no remote exploitation vector. The scope is confined to the vulnerable system with no subsequent system impact (Github Advisory, Feedly).

A proof-of-concept exploit is publicly available as a runnable Python script in the GitHub issue tracker, demonstrating the cache key collision without requiring external tools or elevated privileges (GitHub Issue). There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.008% (0th percentile), reflecting very low probability of exploitation in the near term (Github Advisory).

1. Identify target: Confirm the target system is running gradio 6.14.0 locally and has the Audio component in use, generating cached numpy audio outputs.
2. Craft colliding audio inputs: Prepare two numpy audio arrays with identical raw bytes (e.g., np.array([0, 1, 2, 3], dtype=np.int16)) but different metadata — for example, one at 8000 Hz WAV and another at 16000 Hz WAV.
3. Trigger cache population: Cause the gradio application to call save_audio_to_cache() with both audio arrays (e.g., by submitting inputs that produce these outputs through the gradio interface).
4. Observe cache collision: Verify that both outputs resolve to the same cache directory (e.g., Path(path_8000).parent == Path(path_16000).parent returns True), confirming the collision.
5. Access misrouted audio: Read the cached audio file from the shared cache directory to obtain audio data that was intended for a different output context, achieving unauthorized read of cached audio (GitHub Issue).

The fix is available via GitHub PR #13394, merged on May 26, 2026, and included in gradio version 6.15.0 and later (the patch changeset targets a patch release). The fix updates save_audio_to_cache() to compute a SHA-256 hash over a versioned metadata blob (including sample_rate, format, dtype, shape, and a schema version tag audio-cache-v1) combined with the raw audio bytes, ensuring distinct cache directories for non-equivalent audio outputs. Users should upgrade gradio to version 6.15.0 or later using pip install --upgrade gradio. As a workaround, restricting local access to the system where gradio is deployed reduces exposure (GitHub PR, Github Advisory).

The vulnerability received minimal public attention given its low severity and local-only attack vector. A brief mention appeared on Bluesky via an automated CVE feed account. No significant vendor statements, researcher commentary, or media coverage beyond standard vulnerability database aggregation was observed (Feedly).