CVE-2024-47168

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enable_monitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access the monitoring dashboard by directly requesting the /monitoring endpoint. This means that sensitive application analytics may still be exposed, particularly in environments where monitoring is expected to be disabled. Users who set enable_monitoring=False to prevent unauthorized access to monitoring data are impacted. Users are advised to upgrade to gradio>=4.44 to address this issue. There are no known workarounds for this vulnerability.

• CWE-670

• https://github.com/gradio-app/gradio/security/advisories/GHSA-hm3c-93pg-4cxwThird Party Advisory

Published

Oct 10, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47161In JetBrains TeamCity before 2024.07.3 password could be exp…6.5
• CVE-2024-47162In JetBrains YouTrack before 2024.3.44799 token could be rev…5.3
• CVE-2024-47164Gradio is an open-source Python package designed for quick p…6.5
• CVE-2024-47165Gradio is an open-source Python package designed for quick p…5.4
• CVE-2024-47166Gradio is an open-source Python package designed for quick p…5.3
• CVE-2024-47167Gradio is an open-source Python package designed for quick p…9.8
• CVE-2024-47169Agnai is an artificial-intelligence-agnostic multi-user, mul…8.8
• CVE-2024-4717A vulnerability was found in Campcodes Complete Web-Based Sc…6.1
• CVE-2024-47170Agnai is an artificial-intelligence-agnostic multi-user, mul…4.3
• CVE-2024-47171Agnai is an artificial-intelligence-agnostic multi-user, mul…4.3
• CVE-2024-47172Computer Vision Annotation Tool (CVAT) is an interactive vid…5.4
• CVE-2024-47173Aimeos is an e-commerce framework. All SaaS and marketplace …5.5