8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28416

CVE-2026-28416: Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space. When a victim application uses gr.load() to load an attacker-controlled Space, the malicious proxy_url from the config is trusted and added to the allowlist, enabling the attacker to access internal services, cloud metadata endpoints, and private networks through the victim's infrastructure. Version 6.6.0 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28416

CVE-2026-28416:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gradio	pip	< 6.6.0	6.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the Gradio library, originating from the gr.load() function. The root cause is the improper handling of the proxy_url parameter within a remote Gradio Space's configuration.

The exploit chain begins when a victim's application uses gradio.external.load (commonly aliased as gr.load) to load a malicious, attacker-controlled Gradio Space. The load function fetches the space's configuration and passes it to gradio.blocks.Blocks.from_config. This method insecurely trusts the proxy_url from the remote configuration, adding it to a set of allowed proxy targets without proper validation. An attacker can set this URL to an internal service or a cloud metadata endpoint (e.g., http://169.254.169.254/).

Once the malicious URL is allow-listed, the attacker can trigger the SSRF by making a request to the Gradio application's built-in proxy endpoint, /proxy={url}. This endpoint is handled by the gradio.routes.reverse_proxy function, which in turn uses gradio.routes.App.build_proxy_request to construct and dispatch the server-side request. Because the attacker's malicious URL is now in the trusted proxy_urls set, the application makes a request to the specified internal service, leading to potential cloud credential theft, internal network scanning, or access to sensitive internal services.

The patch applies a defense-in-depth strategy by adding validation in two places: Blocks.from_config is updated to only add proxy_url values that point to a .hf.space host, and App.build_proxy_request is also updated to independently verify that any URL being proxied belongs to a .hf.space host, preventing the proxy from being used to access arbitrary URLs.

Vulnerable functions

Blocks.from_config

gradio/blocks.py

This class method processes the configuration of a Gradio application loaded from an external source. The vulnerability lies in the fact that it blindly trusted the `proxy_url` value provided in the configuration, adding it to a set of allowed proxy targets (`self.proxy_urls`). An attacker could host a malicious Gradio Space with a config containing a `proxy_url` pointing to an internal service or a cloud metadata endpoint. When a victim's application loads this space using `gr.load()`, this malicious URL would be added to the allowlist, enabling an SSRF attack.

App.build_proxy_request

gradio/routes.py

This method is responsible for constructing the server-side request to a given URL for proxying. The original implementation's validation was insufficient because it relied on the `proxy_urls` set, which could be poisoned by the `Blocks.from_config` vulnerability. This function would then proceed to build a request to the malicious URL supplied by an attacker. The patch adds a critical secondary check to ensure that only URLs hosted on the `hf.space` domain are ever proxied, effectively preventing the SSRF even if the `proxy_urls` set is compromised.

reverse_proxy

gradio/routes.py

This is the FastAPI route handler for the `/proxy={url_path}` endpoint. It is exposed in every Gradio application. An attacker exploits the SSRF vulnerability by sending a request to this endpoint with the `url_path` pointing to a sensitive internal address. This function receives the request and uses the vulnerable `build_proxy_request` method to make a request on behalf of the server. During an exploit, this function would appear in the stack trace as it's the primary entry point for the attack.

load

gradio/external.py

This function is the initial entry point for the vulnerability. A victim application uses `gr.load()` to load a Gradio Space. When loading an attacker-controlled, malicious Space, this function fetches the remote configuration and passes it to the vulnerable `Blocks.from_config` method. This action initiates the entire exploit chain by injecting the malicious `proxy_url` into the application's configuration.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.