Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-48545, is a session fixation issue in Gradio's reverse proxy functionality, identified as GHSA-7hp7-4p35-3cx2. The root cause was the use of a single, shared httpx.AsyncClient instance at the module level in gradio/routes.py. This shared client maintained a persistent cookie jar across all proxy requests for all users of the Gradio application.
An attacker could exploit this by hosting a malicious Gradio Space. When this space was accessed through the proxy, it could return a Set-Cookie header for a parent domain (e.g., Domain=hf.space). The shared httpx client would store this cookie. Subsequently, when any other user made a proxy request to a legitimate Gradio Space on the same parent domain, the shared client would automatically include the attacker's cookie, allowing the attacker to control or fixate the user's session on the legitimate space.
The analysis of the patch feb7237d01f359d2ad4ee42d00344e61692b3b39 pinpoints the vulnerable functions:
Blocks.build_proxy_request: In the vulnerable version, this function used the shared client (client.build_request) to prepare the request. This process attached any cookies from the shared jar that matched the target URL's domain.
reverse_proxy: This function, nested within a route handler, dispatched the request using the shared client (client.send). This is the function that both sent the malicious cookie to the target service and received Set-Cookie headers from malicious services, storing them in the shared jar.
The fix replaces the shared httpx.AsyncClient with a shared httpx.AsyncHTTPTransport. A new httpx.AsyncClient with a fresh, empty cookie jar is now created for every single proxy request within the reverse_proxy function. This ensures that cookies are not shared between different proxy requests, effectively isolating them and mitigating the session fixation vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gradio | pip | < 6.15.0 | 6.15.0 |
