{"data":{"id":"6d205c93-6763-4cee-a9a2-e32b5cf1c0f6","title":"CVE-2026-59806: Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to…","summary":"CVE-2026-59806 affects Gradio before 6.20.0. Unvalidated HTTP/HTTPS URLs passed to the file_fetch() function in the /gradio_api/file= endpoint enable an open redirect and server-side request forgery. A crafted FileData response can target internal endpoints such as cloud metadata services to retrieve sensitive credentials, including EC2 IAM role credentials. VulnCheck rates it CVSS 4.0 4.9 (MEDIUM); NVD has not yet provided an assessment.","solution":"Fixed in 6.20.0 (gradio@6.20.0 release, per the referenced GitHub commit and release tag).","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59806","publishedAt":"2026-07-08T20:16:56.973Z","cveId":"CVE-2026-59806","cweIds":["CWE-601","CWE-918"],"cvssScore":"7.4","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio open redirect and SSRF via /gradio_api/file= endpoint","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00437,"epssCheckedAt":"2026-10-14T06:09:08.182Z","kevDateAdded":null,"advisoryAliases":["GHSA-rj25-5m4j-hcxq"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:46:57.427Z","patchAvailable":null,"disclosureDate":"2026-07-08T20:16:56.973Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}