CVE-2026-59806: Gradio SSRF Vulnerability

CVE-2026-59806 Overview

CVE-2026-59806 affects Gradio versions before 6.20.0. The flaw combines an open redirect with a server-side request forgery (SSRF) condition in the /gradio_api/file= endpoint. The file_fetch() function accepts unvalidated HTTP and HTTPS URLs supplied through a crafted FileData response. Attackers can redirect users to arbitrary external destinations or coerce the server-side client into contacting internal endpoints. Targets include cloud metadata services such as the AWS instance metadata endpoint, enabling retrieval of EC2 IAM role credentials. The issue is tracked under [CWE-601] (Open Redirect) and is documented in the VulnCheck Advisory on Gradio.

Critical Impact
Successful exploitation can expose cloud IAM credentials from instance metadata services and redirect users to attacker-controlled URLs.

Affected Products

Gradio versions prior to 6.20.0
Applications embedding the gradio_api/file= route
Cloud-hosted Gradio deployments on AWS EC2 with IMDS reachable from the workload

Discovery Timeline

2026-07-08 - CVE-2026-59806 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59806

Vulnerability Analysis

Gradio exposes a file-serving route at /gradio_api/file= that dereferences URLs contained in a FileData payload. Before version 6.20.0, the file_fetch() handler did not validate the scheme, host, or destination of user-supplied HTTP and HTTPS URLs. An attacker who controls the FileData response can point the endpoint at arbitrary destinations. The server then either fetches the resource or issues an HTTP redirect that the browser follows. This dual behavior yields both an open redirect against end users and a client-side SSRF primitive against internal network services reachable from the Gradio process.

Root Cause

The root cause is missing URL validation in the file-fetching path. The endpoint trusted URLs embedded in FileData objects without allowlisting schemes or blocking internal address ranges. Link-local metadata addresses such as 169.254.169.254 were reachable through the proxy behavior.

Attack Vector

An attacker crafts a FileData response containing a URL targeting the cloud metadata service or an internal service. When Gradio processes the response through /gradio_api/file=, the server fetches attacker-chosen resources or redirects the user. On AWS EC2 hosts without IMDSv2 enforcement, the request can return IAM role credentials.

python

# Security patch excerpt in gradio/routes.py
# Source: https://github.com/gradio-app/gradio/commit/1c5c53842df9c2750552d85c19a92e7e732cff3f
     file_response,
     move_uploaded_files_to_cache,
     routes_safe_join,
+    secure_url_stream_response,
     upload_fn,
 )
 from gradio.screen_recording_utils import process_video_with_ffmpeg

The patch introduces secure_url_stream_response, routing external URLs through an SSRF-safe proxy that blocks internal ranges and validates schemes.

Detection Methods for CVE-2026-59806

Indicators of Compromise

Outbound requests from Gradio processes to link-local metadata addresses such as 169.254.169.254 or metadata.google.internal.
Access log entries for /gradio_api/file= containing embedded http:// or https:// URLs pointing to RFC1918 or link-local ranges.
Unexpected 3xx responses from the Gradio server referencing external hostnames not associated with the application.
New use of EC2 IAM role credentials from IP addresses outside expected workload ranges.

Detection Strategies

Inspect HTTP access logs for /gradio_api/file= requests whose query values decode to full URLs and flag those targeting private, loopback, or link-local networks.
Monitor egress traffic from Gradio hosts for connections to cloud metadata endpoints and alert on any occurrence.
Correlate AWS CloudTrail AssumeRole and STS activity with the workload's source IP to identify anomalous credential use.

Monitoring Recommendations

Enable IMDSv2 required mode on EC2 instances hosting Gradio to require session tokens.
Log full request URIs at the reverse proxy layer to preserve the raw file= parameter for forensic review.
Alert on Gradio process network flows destined for non-application internal services.

How to Mitigate CVE-2026-59806

Immediate Actions Required

Upgrade Gradio to version 6.20.0 or later, which introduces the SSRF-safe proxy in secure_url_stream_response.
Enforce IMDSv2 with a hop limit of 1 on all EC2 instances running Gradio.
Restrict egress from Gradio workloads to only the destinations required by the application.
Review IAM role permissions attached to Gradio hosts and rotate any credentials suspected of exposure.

Patch Information

The fix is committed in Gradio commit 1c5c5384 and shipped in the Gradio 6.20.0 release. Review the pull request discussion and the issue tracker for design context.

Workarounds

Place Gradio behind a reverse proxy that blocks /gradio_api/file= query values containing http:// or https:// schemes until patching.
Apply network policies denying Gradio containers or hosts access to 169.254.169.254 and other metadata endpoints.
Terminate any inbound FileData payloads at an API gateway that strips URL-typed fields before they reach Gradio.

bash

# Upgrade Gradio to the patched release
pip install --upgrade 'gradio>=6.20.0'

# Enforce IMDSv2 on an existing EC2 instance
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled