AIKIDO-2026-503099

TL;DR

The /gradio_api/file= endpoint accepts any HTTP or HTTPS URL as a path parameter and immediately returns a redirect to that URL without validation. Untrusted URLs can redirect users to arbitrary external sites, and because the client library follows redirects, a crafted file response can drive requests to internal endpoints such as cloud metadata services. This enables client-side server-side request forgery that can retrieve sensitive credentials such as instance role credentials. The fix restricts redirects to an allow-list and serves the URL through a request-forgery-safe proxy that validates the resolved host.