CVE-2026-48545: Gradio < 6.15.0 Cookie Injection via Shared Proxy Client

Synopsis

Cookie injection vulnerability in Gradio before version 6.15.0 allows a remote attacker to perform cross-Space session fixation through a shared module-level HTTP client in the reverse proxy endpoint. The attack requires no authentication but does require the attacker to control a Hugging Face Space and depends on a user making a proxied request, while also involving environmental timing factors. Successful exploitation lets the attacker inject a parent-domain cookie that is automatically replayed into all subsequent proxy requests from the shared client, compromising the session integrity of every user passing through the same Gradio deployment. A patched-image rebuild at version 6.15.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Gradio reverse proxy endpoint over the network; the service must be exposed to or reachable by the attacker across the internet or an accessible network path.

• AuthenticationNot required

  No account or credential is needed to stage the attack; the shared HTTP client is accessible to unauthenticated request flows.

• Victim interactionRequired

  A legitimate user must make a proxied request through the affected Gradio deployment after the attacker's malicious Space has poisoned the shared client's cookie store.

• Attack complexityDetail

  Exploitation depends on environmental sequencing: the attacker's Space must respond with the malicious cookie before or during victim requests, introducing a race-like ordering dependency rather than a straightforward, condition-free exploit.

Blast Radius

• The attacker's injected cookie is replayed automatically into all subsequent proxy requests from the shared HTTP client, letting the attacker fixate or hijack active sessions belonging to other users of the same Gradio deployment.
• Confidential data transmitted in those proxied requests, including stored session tokens and any user-specific payload routed through the reverse proxy, becomes readable by the attacker.
• The attacker can modify the content of proxied requests sent to legitimate Spaces on behalf of other users, enabling unauthorized writes or state changes within those Spaces.