Offensive Testing
Penetration TestingVulnerability AssessmentsRed Team Engagements
Advisory & Research
AI Launch Risk ReviewSecurity Architecture ReviewSecurity ResearchSecurity Awareness Training
Software
Breachwright
Community
AI Security DatabaseAdvent Prompt PwnField Manual
ResearchAboutContact
Get in Touch
← Back to the database
high · 8.2Maintainer reviewedAASD-2026-0002

Gradio gr.load configuration trust enables server-side request forgery

Gradio versions before 6.6.0 trusted a proxy URL supplied by an externally loaded Space and added its host to the application's proxy allowlist. When an application loaded an attacker-controlled Space with gr.load(), a remote attacker could make requests from the Gradio server to internal or otherwise restricted network resources.

Prerequisites

  • The application uses gr.load() with an attacker-controlled or untrusted Space
  • The Gradio server can reach sensitive internal, cloud metadata, or private network services

Potential impact

  • Unauthorized requests from the Gradio server into restricted network zones
  • Potential exposure of cloud metadata, internal services, or sensitive API responses

Mitigations

  • Upgrade Gradio to version 6.6.0 or later
  • Load only explicitly trusted Spaces and avoid composing unreviewed external applications
  • Restrict application egress and block access to cloud metadata services at the network layer

Public sources

vendor advisorycve record

Research note

Not listed in the CISA Known Exploited Vulnerabilities catalog when verified on 2026-07-28.