CVE-2026-27167: 
Gradio vulnerability analysis and mitigation

CVE-2026-27167 is a credential exposure vulnerability in Gradio, an open-source Python package for rapid ML application prototyping, titled "Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret." It affects Gradio versions 4.16.0 through 6.5.x (prior to 6.6.0) and was disclosed on February 27, 2026. The vulnerability allows any remote attacker with network access to steal the server owner's Hugging Face (HF) access token by triggering a mocked OAuth flow. The Feedly threat intelligence data assigns a CVSS v3.1 score of 5.9 (Medium/High), though the GitHub Advisory Database lists it as Low severity with a score of 0.0 due to differing scoring interpretations (GitHub Advisory, Gradio Advisory).

The root cause involves two compounding weaknesses: CWE-798 (Use of Hard-coded Credentials) and CWE-522 (Insufficiently Protected Credentials), both present in gradio/oauth.py. When Gradio runs outside of Hugging Face Spaces and OAuth components such as gr.LoginButton are used, it automatically registers mocked OAuth routes via _add_mocked_oauth_routes(). The function _get_mocked_oauth_info() calls huggingface_hub.get_token() to retrieve the host machine's real HF token (from the HF_TOKEN environment variable or huggingface-cli login) and injects it into the session cookie of any visitor who hits /login/callback. The session cookie's signing secret is derived as (OAUTH_CLIENT_SECRET or "") + "-v4", which defaults to the constant string "-v4" (SHA-256 hashed) when OAUTH_CLIENT_SECRET is unset — a value publicly known from the source code. Since Starlette's SessionMiddleware stores session data as plaintext base64, the token is trivially extractable by base64-decoding the cookie payload without needing to break any signature (Gradio Advisory, GitHub Advisory).

Successful exploitation results in full disclosure of the server owner's Hugging Face access token to any unauthenticated remote attacker, constituting a high confidentiality impact with no integrity or availability impact. With the stolen HF token, an attacker can impersonate the server owner, access private Hugging Face repositories, download or exfiltrate proprietary ML models and datasets, and potentially pivot to other services or APIs authenticated via the same token. The impact is scoped to the confidentiality of the HF token and associated Hugging Face account resources (Gradio Advisory, GitHub Advisory).

A public proof-of-concept (PoC) exploit script is available in the GitHub Security Advisory, requiring only Python and the requests library to execute. Exploitation requires no authentication and no user interaction, though it does require the target application to be network-accessible and using OAuth components with a configured HF token. The EPSS score is approximately 0.029% (0.000400 per Feedly), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Gradio Advisory).

1. Reconnaissance: Identify network-accessible Gradio applications (default port 7860) running versions 4.16.0–6.5.x using tools like Shodan, Censys, or direct scanning. Look for applications exposing a /login/huggingface endpoint, which indicates OAuth components are in use.
2. Trigger the mocked OAuth flow: Send a GET request to http://<target>:7860/login/huggingface. The server will respond with a 307 redirect to /login/callback.
3. Follow the redirect: Allow the redirect to complete (e.g., using requests.Session() with allow_redirects=True). The server executes _get_mocked_oauth_info(), retrieves its own HF token via huggingface_hub.get_token(), and stores it in the visitor's session cookie.
4. Extract the session cookie: Retrieve the session cookie value from the HTTP response.
5. Decode the token: Split the cookie value on the first . to isolate the base64-encoded payload, add padding as needed, and base64-decode it. Parse the resulting JSON to extract oauth_info.access_token, which contains the server owner's real HF token.
6. Use the stolen token: Authenticate to the Hugging Face API using the extracted token (e.g., Authorization: Bearer hf_xxx...) to access private repositories, models, datasets, or other account resources (Gradio Advisory, GitHub Advisory).

• Network: Unexpected GET requests to /login/huggingface and subsequent /login/callback from external or unknown IP addresses in web server access logs; outbound API calls to huggingface.co using the server's HF token from unusual source IPs.
• Logs: Gradio application logs showing repeated hits to /login/huggingface from IPs not associated with legitimate users; session cookie issuance to unknown clients.
• Hugging Face Account: Unexpected API activity, repository access, or token usage events visible in the Hugging Face account's access logs or audit trail, particularly from unfamiliar IP addresses or user agents.
• Environment: Presence of the HF_TOKEN environment variable or huggingface-cli login credentials on a host running a network-accessible Gradio application with OAuth components enabled (Gradio Advisory).

Upgrade Gradio to version 6.6.0 or later, which fixes the vulnerability by removing the insecure mocked OAuth behavior and hardcoded session secret (GitHub Advisory). For organizations unable to upgrade immediately: restrict network access to Gradio applications (avoid server_name="0.0.0.0", share=True, or public port forwarding), and remove or disable OAuth components (gr.LoginButton, gr.OAuthProfile) if not required. Additionally, rotate any Hugging Face tokens that may have been exposed on affected systems, as stolen tokens remain valid until revoked (Gradio Advisory).

The vulnerability was reported by researcher tenbbughunters and published by Gradio maintainer freddyaboulton on February 27, 2026. Qualys has added detection for this vulnerability (detection ID 531004), and Tenable's security research team has also noted the issue. A social media post on infosec.exchange referenced the advisory shortly after disclosure. Community reaction has been relatively muted given the Low/Medium severity rating and the specific preconditions required for exploitation (GitHub Advisory, Gradio Advisory).