CVE-2026-27167: Gradio credential leak via mocked OAuth and hardcoded session secret

CVE-2026-27167 · Severity: low · CVSS 3.1 · Published 2026-03-01

Gradio is a popular Python library used to build web interfaces for machine learning models. A security flaw in its login system allows unauthorized users to steal the server owner's Hugging Face credentials if the application is hosted outside of the Hugging Face platform. This could lead to an attacker gaining full access to the developer's private AI models and data.

Technologies: gradio (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-27167 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27167 being exploited in the wild.
How severe is CVE-2026-27167?
Low severity, with a CVSS score of 3.1, published 1 March 2026.
Which products and versions are affected?
gradio (PyPI) >= 4.16.0, < 6.6.0, ECOSYSTEM:introduced=4.16.0,fixed=6.6.0.
Is there a fix for CVE-2026-27167?
Yes. gradio (PyPI): upgrade to 6.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27167 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-27167?
Check whether you run gradio (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • gradio (PyPI): upgrade to 6.6.0 or later
    pip install "gradio>=6.6.0"

Technical details

Gradio applications using OAuth components (like gr.LoginButton) outside of Hugging Face Spaces automatically enable 'mocked' OAuth routes. The component retrieves the server's own Hugging Face access token via huggingface_hub.get_token() and injects it into the session cookie of any visitor who accesses the /login/callback endpoint. Furthermore, the session cookie is signed using a hardcoded secret derived from a constant string ('-v4') when OAUTH_CLIENT_SECRET is not set. An attacker can trigger the OAuth flow, receive the session cookie, and decode it to extract the server's plaintext access token. This issue is fixed in version 6.6.0.

Affected products

  • gradio-app gradio >= 4.16.0, < 6.6.0

Identifiers

  • CVE-2026-27167
  • GHSA-h3h8-3v2v-rg7m
  • PYSEC-2026-63

Timeline

  • 2026-02-27: disclosed
  • 2026-02-27: patched: Fixed in version 6.6.0
  • 2026-03-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.