{"id":"CVE-2026-54457","aliases":["EUVD-2026-64144","GHSA-824w-x939-6cmc","PYSEC-2026-3541"],"status":"published","title":"TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint","description":"TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound object-storage requests to attacker-chosen internal or cloud-metadata endpoints. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment configuration. This issue is fixed in version 2026.6.0.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00402,"percentile":0.34736,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-552","CWE-918"],"published":"2026-07-15T21:59:40Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"PyPI","package":"tensorzero","fixed_in":["2026.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"tensorzero","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.6.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"tensorzero","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.6.0"}]}],"versions":["2025.10.0","2025.10.1","2025.10.2","2025.10.3","2025.10.4","2025.10.5","2025.10.6","2025.10.7","2025.10.9","2025.11.0","2025.11.1","2025.11.2","2025.11.3","2025.11.4","2025.11.5","2025.11.6","2025.12.0","2025.12.1","2025.12.2","2025.12.3","2025.12.5","2025.12.6","2025.6.0","2025.6.1","2025.6.2","2025.6.3","2025.7.0","2025.7.1","2025.7.2","2025.7.3","2025.7.4","2025.7.5","2025.8.0","2025.8.1","2025.8.2","2025.8.3","2025.8.4","2025.8.5","2025.9.0","2025.9.1","2025.9.3","2025.9.4","2025.9.5","2025.9.6","2026.1.0","2026.1.1","2026.1.2","2026.1.5","2026.1.6","2026.1.7","2026.1.8","2026.2.0","2026.2.1","2026.2.2","2026.3.0","2026.3.1","2026.3.2","2026.3.3","2026.3.4","2026.4.0","2026.4.1","2026.5.0","2026.5.1","2026.5.2"]},{"source":"osv","ecosystem":"PyPI","package":"tensorzero","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.6.0"}]}],"versions":["2025.10.0","2025.10.1","2025.10.2","2025.10.3","2025.10.4","2025.10.5","2025.10.6","2025.10.7","2025.10.9","2025.11.0","2025.11.1","2025.11.2","2025.11.3","2025.11.4","2025.11.5","2025.11.6","2025.12.0","2025.12.1","2025.12.2","2025.12.3","2025.12.5","2025.12.6","2025.6.0","2025.6.1","2025.6.2","2025.6.3","2025.7.0","2025.7.1","2025.7.2","2025.7.3","2025.7.4","2025.7.5","2025.8.0","2025.8.1","2025.8.2","2025.8.3","2025.8.4","2025.8.5","2025.9.0","2025.9.1","2025.9.3","2025.9.4","2025.9.5","2025.9.6","2026.1.0","2026.1.1","2026.1.2","2026.1.5","2026.1.6","2026.1.7","2026.1.8","2026.2.0","2026.2.1","2026.2.2","2026.3.0","2026.3.1","2026.3.2","2026.3.3","2026.3.4","2026.4.0","2026.4.1","2026.5.0","2026.5.1","2026.5.2"]}],"products":[{"vendor":"tensorzero","product":"tensorzero"}],"references":[{"url":"https://github.com/tensorzero/tensorzero/security/advisories/GHSA-824w-x939-6cmc","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/tensorzero/tensorzero/commit/0abbc838bae3394fe7491dad7009670d4e3b6cf8","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/tensorzero/tensorzero/releases/tag/2026.6.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-824w-x939-6cmc","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54457.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54457","tags":["advisory"]},{"url":"https://github.com/tensorzero/tensorzero","tags":["package"]},{"url":"https://pypi.org/project/tensorzero","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54457","title":"TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint","description":"TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound object-storage requests to attacker-chosen internal or cloud-metadata endpoints. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment configuration. This issue is fixed in version 2026.6.0.","status":"published","published":"2026-08-21T20:34:03.632Z","modified":"2026-08-25T13:38:42.654Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-552","CWE-918"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-64144","description":"TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound object-storage requests to attacker-chosen internal or cloud-metadata endpoints. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment configuration. This issue is fixed in version 2026.6.0.","status":"published","published":"2026-08-21T20:34:03Z","modified":"2026-08-25T13:38:42Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:33.385611Z"}],"ghsa":[{"id":"GHSA-824w-x939-6cmc","title":"TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint","description":"### Impact\n\nThe `/internal/object_storage` endpoint accepts a caller-supplied JSON `storage_path` parameter that dynamically overrides the TensorZero `[object_storage]` configuration.\n\nBy abusing the `filesystem` storage type, a caller can read arbitrary files from the gateway filesystem, including files that may contain sensitive credentials. Similarly, by abusing the `s3_compatible` storage type, the caller can coerce the gateway into making outbound object storage requests to attacker-chosen internal/cloud-metadata endpoints.\n\nThis vulnerability only applies when the gateway can be accessed by untrusted callers. If a developer's TensorZero deployment has authentication enabled, only authenticated callers can exploit this vulnerability. If a developer's deployment has authentication disabled, any caller can exploit this vulnerability.\n\n### Remediation\n\nThe vulnerability has been patched in version `2026.6.0`. See PR #7527.\n\n### Workarounds\n\nIf developers are unable to upgrade a gateway that is exposed to untrusted callers, please block external access to the `/internal/object_storage` endpoint.","status":"published","published":"2026-07-15T21:59:40Z","modified":"2026-07-15T21:59:41Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-552","CWE-918"],"updated_at":"2026-11-02T14:40:43.958448Z"}],"nvd":[{"id":"CVE-2026-54457","description":"TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound object-storage requests to attacker-chosen internal or cloud-metadata endpoints. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment configuration. This issue is fixed in version 2026.6.0.","status":"published","published":"2026-08-21T21:17:00.267Z","modified":"2026-10-14T19:10:00.297Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-552","CWE-918"],"updated_at":"2026-11-02T14:12:40.665005Z"}],"osv":[{"id":"CVE-2026-54457","title":"TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint","description":"TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound object-storage requests to attacker-chosen internal or cloud-metadata endpoints. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment configuration. This issue is fixed in version 2026.6.0.","status":"published","published":"2026-08-21T20:34:03.632Z","modified":"2026-10-28T02:30:48.879503275Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-552","CWE-918"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-824w-x939-6cmc","title":"TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint","description":"### Impact\n\nThe `/internal/object_storage` endpoint accepts a caller-supplied JSON `storage_path` parameter that dynamically overrides the TensorZero `[object_storage]` configuration.\n\nBy abusing the `filesystem` storage type, a caller can read arbitrary files from the gateway filesystem, including files that may contain sensitive credentials. Similarly, by abusing the `s3_compatible` storage type, the caller can coerce the gateway into making outbound object storage requests to attacker-chosen internal/cloud-metadata endpoints.\n\nThis vulnerability only applies when the gateway can be accessed by untrusted callers. If a developer's TensorZero deployment has authentication enabled, only authenticated callers can exploit this vulnerability. If a developer's deployment has authentication disabled, any caller can exploit this vulnerability.\n\n### Remediation\n\nThe vulnerability has been patched in version `2026.6.0`. See PR #7527.\n\n### Workarounds\n\nIf developers are unable to upgrade a gateway that is exposed to untrusted callers, please block external access to the `/internal/object_storage` endpoint.","status":"published","published":"2026-07-15T21:59:40Z","modified":"2026-07-23T15:11:46.928899331Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-552","CWE-918"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"PYSEC-2026-3541","title":"TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint","description":"### Impact\n\nThe `/internal/object_storage` endpoint accepts a caller-supplied JSON `storage_path` parameter that dynamically overrides the TensorZero `[object_storage]` configuration.\n\nBy abusing the `filesystem` storage type, a caller can read arbitrary files from the gateway filesystem, including files that may contain sensitive credentials. Similarly, by abusing the `s3_compatible` storage type, the caller can coerce the gateway into making outbound object storage requests to attacker-chosen internal/cloud-metadata endpoints.\n\nThis vulnerability only applies when the gateway can be accessed by untrusted callers. If a developer's TensorZero deployment has authentication enabled, only authenticated callers can exploit this vulnerability. If a developer's deployment has authentication disabled, any caller can exploit this vulnerability.\n\n### Remediation\n\nThe vulnerability has been patched in version `2026.6.0`. See PR #7527.\n\n### Workarounds\n\nIf developers are unable to upgrade a gateway that is exposed to untrusted callers, please block external access to the `/internal/object_storage` endpoint.","status":"published","published":"2026-07-23T11:41:45.645277Z","modified":"2026-07-23T15:00:23.851798535Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:56.847083Z"}]}}