TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint
Impact
The /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the TensorZero [object_storage] configuration.
By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may contain sensitive credentials. Similarly, by abusing the s3_compatible storage type, the caller can coerce the gateway into making outbound object storage requests to attacker-chosen internal/cloud-metadata endpoints.
This vulnerability only applies when the gateway can be accessed by untrusted callers. If a developer's TensorZero deployment has authentication enabled, only authenticated callers can exploit this vulnerability. If a developer's deployment has authentication disabled, any caller can exploit this vulnerability.
Remediation
The vulnerability has been patched in version 2026.6.0. See PR #7527.
Workarounds
If developers are unable to upgrade a gateway that is exposed to untrusted callers, please block external access to the /internal/object_storage endpoint.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | tensorzero | < 2026.6.0 | 2026.6.0 |
Referencias
- https://github.com/tensorzero/tensorzero/security/advisories/GHSA-824w-x939-6cmc
- https://github.com/tensorzero/tensorzero/commit/0abbc838bae3394fe7491dad7009670d4e3b6cf8
- https://github.com/tensorzero/tensorzero
- https://github.com/tensorzero/tensorzero/releases/tag/2026.6.0
- https://pypi.org/project/tensorzero
- https://github.com/advisories/GHSA-824w-x939-6cmc
- https://nvd.nist.gov/vuln/detail/CVE-2026-54457
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N- Debilidad (CWE)
CWE-552, CWE-918- Plataforma
- Python (PyPI)
- Paquete
tensorzero- Publicada
- 15.07.2026
- Actualizado
- 11.10.2026 14:18
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-3541 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-824w-x939-6cmc - CC BY 4.0
Historial de vulnerabilidades: tensorzero
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.