CVE-2026-28416: Gradio SSRF Vulnerability in gr.load()

CVE-2026-28416 Overview

CVE-2026-28416 is a Server-Side Request Forgery (SSRF) vulnerability affecting Gradio, an open-source Python package designed for quick prototyping of machine learning applications. The vulnerability exists in versions prior to 6.6.0 and allows attackers to make arbitrary HTTP requests from a victim's server by hosting a malicious Gradio Space.

When a victim application uses the gr.load() function to load an attacker-controlled Space, the malicious proxy_url from the configuration is implicitly trusted and added to the allowlist. This enables attackers to access internal services, cloud metadata endpoints, and private networks through the victim's infrastructure.

Critical Impact

Attackers can leverage this SSRF vulnerability to access cloud metadata endpoints (such as AWS IMDSv1), internal services, and private network resources, potentially leading to credential theft, lateral movement, and data exfiltration.

Affected Products

• Gradio versions prior to 6.6.0
• Applications using gr.load() to load external Gradio Spaces
• Python environments running vulnerable Gradio installations

Discovery Timeline

• 2026-02-27 - CVE-2026-28416 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28416

Vulnerability Analysis

This vulnerability (CWE-918: Server-Side Request Forgery) occurs due to improper validation of the proxy_url configuration parameter when loading external Gradio Spaces. The gr.load() function is designed to dynamically load Gradio interfaces from remote sources, including Hugging Face Spaces. However, the implementation fails to properly validate and sanitize the proxy_url value received from the remote Space's configuration.

When a malicious Space is loaded, the attacker-controlled proxy_url is automatically added to the application's allowlist without verification. This bypasses security controls and allows the attacker to instruct the victim's server to make HTTP requests to arbitrary destinations.

Root Cause

The root cause lies in the implicit trust placed on configuration data received from external Gradio Spaces. The gr.load() function accepts the proxy_url parameter from untrusted sources and adds it to the application's allowlist without proper validation. This design flaw assumes that all Gradio Spaces are benign, which creates an exploitation vector for attackers who can host malicious Spaces.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker hosts a malicious Gradio Space containing a crafted proxy_url in its configuration. When a victim application calls gr.load() to load this Space, the malicious URL is trusted and added to the allowlist.

The attacker can then leverage this to:

1. Access cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/) to steal IAM credentials
2. Probe and access internal services on private networks
3. Enumerate internal infrastructure and services
4. Bypass firewall rules and network segmentation controls

The vulnerability manifests in the Space loading mechanism where the proxy_url configuration is processed. When a victim loads an attacker-controlled Space using gr.load(), the malicious proxy URL is accepted without validation. This allows the attacker to instruct the victim's server to make requests to internal endpoints or cloud metadata services. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-28416

Indicators of Compromise

• Unexpected outbound HTTP requests from Gradio applications to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• HTTP requests targeting cloud metadata endpoints such as 169.254.169.254
• Unusual gr.load() calls loading Spaces from untrusted or unknown sources
• Anomalous network traffic patterns from applications hosting Gradio interfaces

Detection Strategies

• Monitor network traffic for outbound requests to cloud metadata endpoints (169.254.169.254) and internal IP ranges
• Implement egress filtering and logging to detect SSRF attempts from Gradio applications
• Audit application code for gr.load() calls that load external or user-controlled Spaces
• Use runtime application security monitoring to detect unexpected HTTP requests originating from Gradio components

Monitoring Recommendations

• Enable detailed logging for all outbound HTTP requests from Gradio applications
• Configure network monitoring to alert on connections to internal services from web-facing applications
• Implement cloud provider metadata service protections (e.g., IMDSv2 on AWS) to limit credential exposure
• Deploy web application firewalls (WAF) with SSRF detection rules for Gradio endpoints

How to Mitigate CVE-2026-28416

Immediate Actions Required

• Upgrade Gradio to version 6.6.0 or later immediately
• Audit all gr.load() calls in your application to ensure only trusted Spaces are loaded
• Implement network segmentation to limit the blast radius of potential SSRF attacks
• Enable IMDSv2 or equivalent metadata service hardening on cloud instances running Gradio applications
• Review logs for any suspicious outbound requests that may indicate prior exploitation

Patch Information

The vulnerability has been fixed in Gradio version 6.6.0. The fix addresses the improper trust of proxy_url configurations from external Spaces. Users should upgrade to this version or later to remediate the vulnerability. For additional details, refer to the GitHub Security Advisory GHSA-jmh7-g254-2cq9.

Workarounds

• Avoid using gr.load() to load external or untrusted Gradio Spaces until the patch is applied
• Implement strict network egress controls to block access to internal networks and metadata endpoints from Gradio applications
• Use a reverse proxy or firewall to restrict outbound connections from Gradio to known-good destinations only
• If cloud-based, enable metadata service endpoint restrictions (IMDSv2, GCP metadata concealment) to reduce credential theft risk

# Upgrade Gradio to patched version
pip install --upgrade gradio>=6.6.0

# Verify installed version
pip show gradio | grep Version