High, CVSS 7.7PyPIAmendedPublished
TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint
CVE-2026-54457 · GHSA-824w-x939-6cmc
- Affected
- PyPI tensorzero < 2026.6.0
- Fixed in
- 2026.6.0· Vendor fix available
- Issue
- Impact The /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the TensorZero [objectstorage] configuration. By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may contain sensitive credentials. Similarly, by abusing the s3compatible storage type, the caller can coerce the gateway into making outbound object storage requests to attacker-chosen internal/cloud-metadata endpoints. This vulnerability only applies when the gateway can be accessed by untrusted callers. If a developer's TensorZero deployment has authentication enabled, only authenticated callers can exploit this vulnerability. If a developer's deployment has authentication disabled, any caller can exploit this vulnerability. Remediation The vulnerability has been patched in version 2026.6.0. See PR #7527. Workarounds If developers are unable to upgrade a gateway that is exposed to untrusted…
Recommended action: Upgrade to 2026.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.