NVD HIGH: CVE-2026-59806 — Gradio before 6.20.0 contains an open redirect and server-side request forgery v...

Wednesday, July 8, 2026 at 08:16 PM UTC·Source: NIST NVD

Updated: Wednesday, July 8, 2026 at 09:00 PM UTC

Executive Summary

Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perform client-side SSRF by supplying unvalidated HTTP/HTTPS URLs to the file_fetch() function in the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response targeting internal endpoints such as cloud metadata services to re

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-59806

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Jul 8, 2026. Verified by: NIST.

Related Threats

LOWVulnerability

Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours

The attacker exploited AI workflows, chained cloud weaknesses, and stolen credentials to extort a large Amazon customer.

1h agoDark Reading

MEDIUMVulnerability

Greek victims file lawsuit against Intellexa over Predator spyware

The use of the spyware came to light in 2022, with traces of Predator found on dozens of phones. The scandal led to the resignation of Greece’s intelligence service chief and the prime minister’s chief of staff.

1h agoThe Record

HIGHVulnerability

NVD HIGH: CVE-2026-60104 — Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-...

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthen

CVE-2026-60104

1h agoNIST NVD