Vulnerability Description
Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the reverse proxy endpoint. Attackers controlling any HF Space can return a parent-domain cookie that the shared client stores and automatically replays into all subsequent proxy requests to other legitimate Spaces, affecting all users of the same Gradio deployment.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gradio Project | Gradio | < 6.15.0 |
Related Weaknesses (CWE)
References
- https://github.com/gradio-app/gradio/commit/feb7237d01f359d2ad4ee42d00344e61692bPatch
- https://github.com/gradio-app/gradio/issues/13369Issue Tracking
- https://github.com/gradio-app/gradio/pull/13384Issue TrackingPatch
- https://github.com/gradio-app/gradio/releases/tag/gradio%406.15.0ProductRelease Notes
- https://www.vulncheck.com/advisories/gradio-cookie-injection-via-shared-proBroken Link
- https://github.com/gradio-app/gradio/issues/13369Issue Tracking
FAQ
What is CVE-2026-48545?
CVE-2026-48545 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across ...
How severe is CVE-2026-48545?
CVE-2026-48545 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-48545?
Check the references section above for vendor advisories and patch information. Affected products include: Gradio Project Gradio.