Security readout for executives and security teams
Plain-English summary
A vulnerable Gradio app can leak the server owner’s Hugging Face token to any remote visitor when mocked OAuth is enabled outside Hugging Face Spaces. The token is placed in a session cookie protected by a hardcoded secret. If that token has meaningful permissions, this can become credential compromise, not just an application bug.
Executive priority
Treat this as urgent for exposed Gradio applications because it can disclose service credentials. Prioritize systems with Hugging Face tokens that can access private models, datasets, or organizational resources. Upgrade and rotate potentially exposed tokens promptly.
Technical view
Gradio versions 4.16.0 through before 6.6.0 automatically enable mocked OAuth routes outside Hugging Face Spaces when OAuth components are used. Visiting the Hugging Face login route causes the server to retrieve its own Hugging Face token and store it in the visitor’s signed session cookie. The signing secret is hardcoded, making the session payload decodable. Fixed in 6.6.0.
Likely exposure
Exposure is most likely for internet- or network-accessible Gradio apps running affected versions, outside Hugging Face Spaces, using OAuth components such as gr.LoginButton, and configured with a Hugging Face token available to the server.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not marked KEV. The issue is remotely reachable in exposed apps and does not require authentication, but practical impact depends on whether a server Hugging Face token exists and what permissions it has.
Researcher notes
The public record describes CWE-522 and CWE-798 conditions: credential exposure through session storage and a hardcoded signing secret. The CVSS data in the bundle appears inconsistent with the described confidentiality impact, so risk should be based on deployment context and token privilege.
Mitigation direction
- Upgrade Gradio to version 6.6.0 or later.
- Rotate Hugging Face tokens that may have been exposed.
- Review vendor advisory for any additional guidance.
- Limit network exposure for Gradio apps until upgraded.
- Avoid affected OAuth components on vulnerable versions where feasible.
Validation and detection
- Inventory Gradio deployments and package versions.
- Identify apps using OAuth components such as gr.LoginButton.
- Confirm whether affected apps run outside Hugging Face Spaces.
- Check whether vulnerable apps are network-accessible.
- Review access logs for Hugging Face login route activity.
- Assess permissions of Hugging Face tokens available to servers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-522: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-798: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-27167 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- None
- CVSS
- 0 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N2.20Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
0NoneVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/gradio-app/gradio/security/advisories/GHSA-h3h8-3v2v-rg7mCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficiently Protected Credentials
Insufficiently Protected Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Use of Hard-coded Credentials
Use of Hard-coded Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.