CVE-2026-27167

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27167", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-18T00:18:53.963Z", "datePublished": "2026-02-27T21:40:57.917Z", "dateUpdated": "2026-03-02T22:02:47.868Z"}, "containers": {"cna": {"title": "Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret", "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "lang": "en", "description": "CWE-798: Use of Hard-coded Credentials", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-522", "lang": "en", "description": "CWE-522: Insufficiently Protected Credentials", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/gradio-app/gradio/security/advisories/GHSA-h3h8-3v2v-rg7m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-h3h8-3v2v-rg7m"}], "affected": [{"vendor": "gradio-app", "product": "gradio", "versions": [{"version": ">= 4.16.0, < 6.6.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T21:40:57.917Z"}, "descriptions": [{"lang": "en", "value": "Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable \"mocked\" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingface_hub.get_token()` and stores it in the visitor's session cookie. If the application is network-accessible, any remote attacker can trigger this flow to steal the server owner's HF token. The session cookie is signed with a hardcoded secret derived from the string `\"-v4\"`, making the payload trivially decodable. Version 6.6.0 fixes the issue."}], "source": {"advisory": "GHSA-h3h8-3v2v-rg7m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T22:02:38.342689Z", "id": "CVE-2026-27167", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T22:02:47.868Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27167", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T22:02:38.342689Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T22:02:44.083Z"}}], "cna": {"title": "Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret", "source": {"advisory": "GHSA-h3h8-3v2v-rg7m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 0, "attackVector": "NETWORK", "baseSeverity": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "gradio-app", "product": "gradio", "versions": [{"status": "affected", "version": ">= 4.16.0, < 6.6.0"}]}], "references": [{"url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-h3h8-3v2v-rg7m", "name": "https://github.com/gradio-app/gradio/security/advisories/GHSA-h3h8-3v2v-rg7m", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable \"mocked\" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingface_hub.get_token()` and stores it in the visitor's session cookie. If the application is network-accessible, any remote attacker can trigger this flow to steal the server owner's HF token. The session cookie is signed with a hardcoded secret derived from the string `\"-v4\"`, making the payload trivially decodable. Version 6.6.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798: Use of Hard-coded Credentials"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T21:40:57.917Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27167", "state": "PUBLISHED", "dateUpdated": "2026-03-02T22:02:47.868Z", "dateReserved": "2026-02-18T00:18:53.963Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-27T21:40:57.917Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gradio", "vendor": "gradio-app", "versions": [{"status": "affected", "version": ">= 4.16.0, < 6.6.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*", "matchCriteriaId": "28401826-0343-4F00-8038-0291A834E4E5", "versionEndExcluding": "6.6.0", "versionStartIncluding": "4.16.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable \"mocked\" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingface_hub.get_token()` and stores it in the visitor's session cookie. If the application is network-accessible, any remote attacker can trigger this flow to steal the server owner's HF token. The session cookie is signed with a hardcoded secret derived from the string `\"-v4\"`, making the payload trivially decodable. Version 6.6.0 fixes the issue."}, {"lang": "es", "value": "Gradio es un paquete Python de c\u00f3digo abierto dise\u00f1ado para la creaci\u00f3n r\u00e1pida de prototipos. A partir de la versi\u00f3n 4.16.0 y antes de la versi\u00f3n 6.6.0, las aplicaciones de Gradio que se ejecutan fuera de Hugging Face Spaces habilitan autom\u00e1ticamente rutas OAuth 'simuladas' cuando se utilizan componentes OAuth (por ejemplo, 'gr.LoginButton'). Cuando un usuario visita '/login/huggingface', el servidor recupera su propio token de acceso de Hugging Face a trav\u00e9s de 'huggingface_hub.get_token()' y lo almacena en la cookie de sesi\u00f3n del visitante. Si la aplicaci\u00f3n es accesible por red, cualquier atacante remoto puede activar este flujo para robar el token HF del propietario del servidor. La cookie de sesi\u00f3n est\u00e1 firmada con un secreto codificado derivado de la cadena '-v4', lo que hace que la carga \u00fatil sea trivialmente decodificable. La versi\u00f3n 6.6.0 corrige el problema."}], "id": "CVE-2026-27167", "lastModified": "2026-06-17T10:26:46.917", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 0.0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 0.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27167", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T22:02:38.342689Z", "version": "2.0.3"}}]}, "published": "2026-02-27T22:16:22.820", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-h3h8-3v2v-rg7m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}, {"lang": "en", "value": "CWE-798"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Gradio: Gradio: Information disclosure due to hardcoded secret in session cookie signing, allowing remote attackers to steal Hugging Face tokens.", "id": "2443454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443454"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-798", "details": ["Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable \"mocked\" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingface_hub.get_token()` and stores it in the visitor's session cookie. If the application is network-accessible, any remote attacker can trigger this flow to steal the server owner's HF token. The session cookie is signed with a hardcoded secret derived from the string `\"-v4\"`, making the payload trivially decodable. Version 6.6.0 fixes the issue.", "A flaw was found in Gradio. When Gradio applications run outside of Hugging Face Spaces and use OAuth components, they automatically enable \"mocked\" OAuth routes. A remote attacker can exploit this by visiting the /login/huggingface endpoint, which causes the server to retrieve its Hugging Face (HF) access token and store it in the visitor's session cookie. Since the session cookie is signed with a hardcoded secret, the attacker can easily decode the payload and steal the server owner's HF token, leading to information disclosure."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict network access to Gradio applications that utilize OAuth components and are deployed outside of Hugging Face Spaces. Implement firewall rules or a reverse proxy to limit exposure of the application's `/login/huggingface` endpoint to trusted networks only. If feasible, avoid using OAuth components in self-hosted Gradio deployments until a version with a proper fix is available."}, "name": "CVE-2026-27167", "public_date": "2026-02-27T21:40:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-27167\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27167\nhttps://github.com/gradio-app/gradio/security/advisories/GHSA-h3h8-3v2v-rg7m"], "statement": "This vulnerability in Gradio applications, specifically affecting `ansible-chatbot-service` in Ansible Services, allows a remote attacker to obtain the server owner's Hugging Face access token. This occurs when network-accessible Gradio applications utilize OAuth components outside of Hugging Face Spaces, leading to the automatic enablement of \"mocked\" OAuth routes. The session cookie, containing the token, is signed with a hardcoded secret, making it trivially decodable.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.16.0,6.6.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "gradio", "source": "cna", "vendor": "gradio-app"}, "product": "gradio", "vendor": "gradio-app"}], "analysis": {"en": {"generated_at": "2026-04-16T15:13:17.689395+00:00", "value": {"mitigation_remediation": ["Upgrade Gradio to version 6.6.0 or newer to apply the vendor fix that removes the mocked OAuth flow and uses a proper session secret. ", "If an upgrade cannot be performed immediately, disable or remove OAuth components such as gr.LoginButton from the application code to eliminate the vulnerable route. ", "Restrict access to the Gradio application by placing it behind authentication, firewall rules, or an internal network so that external attackers cannot trigger the /login/huggingface endpoint."], "summary": {"action": "Immediate Patch", "impact": "Remote Credential Theft"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Gradio package distributed by gradio-app. Any deployment of Gradio version 4.16.0 up to and including 6.5.0 that is exposed to external network traffic and uses OAuth UI components is impacted. Gradio 6.6.0 and later versions contain the fix and are not affected.", "description_and_impact": "Gradio applications built with versions starting at 4.16.0 through 6.5.0 expose a flaw when OAuth components such as gr.LoginButton are employed outside of Hugging Face Spaces. By visiting the special /login/huggingface route, the server automatically retrieves its own Hugging Face access token and stores it inside the visitor\u2019s session cookie. The session cookie is signed with a hardcoded secret derived from the string \"-v4\", which means the cookie can be decoded trivially. An attacker who can reach the application over the network can trigger this flow and capture the server\u2019s credentials, compromising the entire Hugging Face integration. This is a classic case of improper secret management and storage of sensitive data in client-side cookies.", "risk_and_exploitability": "Detailed severity is not provided, but the potential to exfiltrate server credentials makes the impact high. The EPSS score indicates that current public exploitation probability is very low (<1%). The vulnerability is not listed in CISA\u2019s KEV catalog, suggesting it has not been actively exploited in the wild yet. The likely attack vector is a remote, unauthenticated user accessing the exposed /login/huggingface endpoint, which then results in credential theft. Exploitation requires only network connectivity to the vulnerable service and the presence of OAuth components in the code."}}}}, "created": "2026-03-02T12:04:47.032794+00:00", "updated": "2026-04-16T15:15:39.049171+00:00", "vendors": ["gradio-app", "gradio-app$PRODUCT$gradio"]}