{"id":"PYSEC-2026-3541","summary":"TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint","details":"### Impact\n\nThe `/internal/object_storage` endpoint accepts a caller-supplied JSON `storage_path` parameter that dynamically overrides the TensorZero `[object_storage]` configuration.\n\nBy abusing the `filesystem` storage type, a caller can read arbitrary files from the gateway filesystem, including files that may contain sensitive credentials. Similarly, by abusing the `s3_compatible` storage type, the caller can coerce the gateway into making outbound object storage requests to attacker-chosen internal/cloud-metadata endpoints.\n\nThis vulnerability only applies when the gateway can be accessed by untrusted callers. If a developer's TensorZero deployment has authentication enabled, only authenticated callers can exploit this vulnerability. If a developer's deployment has authentication disabled, any caller can exploit this vulnerability.\n\n### Remediation\n\nThe vulnerability has been patched in version `2026.6.0`. See PR #7527.\n\n### Workarounds\n\nIf developers are unable to upgrade a gateway that is exposed to untrusted callers, please block external access to the `/internal/object_storage` endpoint.","aliases":["CVE-2026-54457","GHSA-824w-x939-6cmc"],"modified":"2026-07-23T15:00:23.851798535Z","published":"2026-07-23T11:41:45.645277Z","references":[{"type":"WEB","url":"https://github.com/tensorzero/tensorzero/security/advisories/GHSA-824w-x939-6cmc"},{"type":"WEB","url":"https://github.com/tensorzero/tensorzero/commit/0abbc838bae3394fe7491dad7009670d4e3b6cf8"},{"type":"PACKAGE","url":"https://github.com/tensorzero/tensorzero"},{"type":"WEB","url":"https://github.com/tensorzero/tensorzero/releases/tag/2026.6.0"},{"type":"PACKAGE","url":"https://pypi.org/project/tensorzero"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-824w-x939-6cmc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54457"}],"affected":[{"package":{"name":"tensorzero","ecosystem":"PyPI","purl":"pkg:pypi/tensorzero"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.6.0"}]}],"versions":["2025.10.0","2025.10.1","2025.10.2","2025.10.3","2025.10.4","2025.10.5","2025.10.6","2025.10.7","2025.10.9","2025.11.0","2025.11.1","2025.11.2","2025.11.3","2025.11.4","2025.11.5","2025.11.6","2025.12.0","2025.12.1","2025.12.2","2025.12.3","2025.12.5","2025.12.6","2025.6.0","2025.6.1","2025.6.2","2025.6.3","2025.7.0","2025.7.1","2025.7.2","2025.7.3","2025.7.4","2025.7.5","2025.8.0","2025.8.1","2025.8.2","2025.8.3","2025.8.4","2025.8.5","2025.9.0","2025.9.1","2025.9.3","2025.9.4","2025.9.5","2025.9.6","2026.1.0","2026.1.1","2026.1.2","2026.1.5","2026.1.6","2026.1.7","2026.1.8","2026.2.0","2026.2.1","2026.2.2","2026.3.0","2026.3.1","2026.3.2","2026.3.3","2026.3.4","2026.4.0","2026.4.1","2026.5.0","2026.5.1","2026.5.2"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/tensorzero/PYSEC-2026-3541.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}]}