CVE-2026-54457: 
Python Schwachstellenanalyse und -minderung

CVE-2026-54457 is a combined arbitrary file read and Server-Side Request Forgery (SSRF) vulnerability in the TensorZero Gateway's /internal/object_storage endpoint. It affects all versions of the tensorzero pip package and tensorzero/gateway Docker image prior to 2026.6.0. The vulnerability was originally published on June 4, 2026, by GabrielBianconi, and added to the GitHub Advisory Database on July 15, 2026. It carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, TensorZero Advisory).

The root cause is insufficient validation of a caller-supplied storage_path JSON parameter accepted by the /internal/object_storage endpoint, which dynamically overrides the gateway's [object_storage] configuration (CWE-552, CWE-918). By specifying the filesystem storage type, an attacker can direct the gateway to read arbitrary files from its local filesystem — including credential files. By specifying the s3_compatible storage type with an attacker-controlled endpoint, the gateway can be coerced into making outbound HTTP requests to internal or cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), constituting a classic SSRF attack. The fix, implemented in PR #7527 (commit 0abbc83), hardens the endpoint so the gateway only fetches objects using its own configured [object_storage] store, rejecting caller-supplied storage roots or S3 endpoints (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to read arbitrary files from the gateway's filesystem, potentially exposing sensitive credentials such as API keys, database passwords, or cloud provider secrets. Via the SSRF vector, an attacker can pivot to internal network services or cloud metadata endpoints (e.g., to steal IAM credentials in cloud-hosted deployments), enabling lateral movement beyond the gateway itself. There is no integrity or availability impact, but the confidentiality impact is rated High due to the potential for full credential exposure and cloud account compromise (TensorZero Advisory).

1. Reconnaissance: Identify internet-facing TensorZero Gateway instances running versions prior to 2026.6.0 by probing the /health endpoint or inspecting HTTP response headers for version information.
2. Authenticate (if required): If the target deployment has authentication enabled, obtain valid credentials (e.g., via phishing or credential stuffing) to make authenticated API calls.
3. Arbitrary File Read: Send a crafted HTTP request to the /internal/object_storage endpoint with a JSON body specifying storage_path using the filesystem type and a target path such as /etc/passwd, ~/.aws/credentials, or application configuration files containing secrets.

   GET /internal/object_storage?storage_path={"type":"filesystem","path":"/etc/passwd"}

4. SSRF via S3-Compatible Type: Alternatively, supply an s3_compatible storage type with endpoint set to an internal address (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) to coerce the gateway into making outbound requests to cloud metadata services and retrieve IAM credentials.
5. Exfiltrate Credentials: Use retrieved credentials (cloud IAM tokens, API keys, database passwords) for lateral movement, privilege escalation, or further compromise of the environment (TensorZero Advisory, GitHub Advisory).

• Network: Unusual outbound HTTP requests from the TensorZero Gateway process to internal IP ranges (e.g., 169.254.169.254, RFC-1918 addresses) or unexpected S3-compatible endpoints; inbound requests to /internal/object_storage with storage_path parameters containing filesystem paths or non-configured S3 endpoints.
• Logs: Gateway access logs showing requests to /internal/object_storage with storage_path values referencing local filesystem paths (e.g., /etc/, /root/, ~/.aws/) or attacker-controlled S3 endpoints; HTTP 200 responses to such requests indicating successful reads.
• File System: No direct file system artifacts are expected on the gateway host from exploitation itself, but evidence of credential file access may appear in OS-level audit logs (e.g., auditd records for file reads on sensitive paths).
• Process: Unexpected outbound network connections initiated by the gateway process to cloud metadata IPs or internal services not part of normal operation (TensorZero Advisory).

Upgrade the tensorzero pip package or tensorzero/gateway Docker image to version 2026.6.0 or later, which hardens the /internal/object_storage endpoint to only serve objects from the gateway's own configured [object_storage] store, rejecting caller-supplied storage roots or endpoints. For deployments that cannot be immediately upgraded and are exposed to untrusted callers, block all external access to the /internal/object_storage endpoint at the network or reverse proxy layer. Deployments with authentication enabled limit exposure to authenticated callers only, but upgrading remains the recommended remediation (TensorZero Advisory, Release 2026.6.0).