CVE-2026-27167 Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
Remote attackers can steal server Hugging Face tokens via mocked OAuth routes using a hardcoded session secret in Gradio applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27167?
CVE-2026-27167 is a vulnerability in Gradio Project Gradio, published on 27 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outside of Hugging Face Spaces automatically enable "mocked" OAuth routes when OAuth components (e.g. `gr.LoginButton`) are used. When a user visits `/login/huggingface`, the server retrieves its own Hugging Face access token via `huggingface_hub.get_token()` and stores it in the visitor's session cookie. If the application is network-accessible, any remote attacker can trigger this flow to steal the server owner's HF token. The session cookie is signed with a hardcoded secret derived from the string `"-v4"`, making the payload trivially decodable. Version 6.6.0 fixes the issue.
Which versions are affected by CVE-2026-27167?
3 open source packages ship an affected version, including gradio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gradio PyPI | From 4.16.0 | 6.6.0 |
gradio PyPI | From 4.16.0 | 6.6.0 |
gradio PyPI | From 4.16.0 | 6.6.0 |
Products include Gradio Project Gradio.
How do I fix CVE-2026-27167?
Upgrade gradio to 6.6.0 or later.
Is CVE-2026-27167 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27167 exists.
Other vulnerabilities in Gradio Project Gradio
- CVE-2024-39236 Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py
- CVE-2023-6572 Command Injection in gradio-app/gradio
- CVE-2022-24770 Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging
- CVE-2026-49119 Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()
- CVE-2025-23042 Gradio Blocked Path ACL Bypass Vulnerability
Sources
Also known as GHSA-h3h8-3v2v-rg7m, PYSEC-2026-63.