CVE-2026-59806 Details
Description
Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perform client-side SSRF by supplying unvalidated HTTP/HTTPS URLs to the file_fetch() function in the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response targeting internal endpoints such as cloud metadata services to retrieve sensitive credentials including EC2 IAM role credentials.
A vulnerability in Gradio versions prior to 6.20.0 allows for open redirect and server-side request forgery (SSRF) via the '/gradio_api/file=' endpoint. The issue arises because the 'file_fetch()' function does not validate HTTP or HTTPS URLs before redirecting users or fetching data. This flaw can be exploited to redirect users to malicious sites or, in the case of SSRF, access internal services such as cloud metadata APIs to steal sensitive information like EC2 IAM role credentials.
Users can update to Gradio version 6.20.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gradio-app/gradio/commit/1c5c53842df9c2750552d85c19a92e7e732cff3f | [email protected] | Source CodeVendor |
| https://github.com/gradio-app/gradio/issues/13593 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/gradio-app/gradio/pull/13596 | [email protected] | Issue TrackingVendor |
| https://github.com/gradio-app/gradio/releases/tag/gradio%406.20.0 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/gradio-open-redirect-and-ssrf-via-gradio-api-file-endpoint | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gradio | < 6.20.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |