CVE-2026-54457: 
Python vulnerability analysis and mitigation

CVE-2026-54457 is a combined arbitrary file read and Server-Side Request Forgery (SSRF) vulnerability in the TensorZero Gateway's /internal/object_storage endpoint. It affects all versions of the tensorzero pip package and tensorzero/gateway Docker image prior to 2026.6.0. The vulnerability was originally published on June 4, 2026, by GabrielBianconi, and added to the GitHub Advisory Database on July 15, 2026. It carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, TensorZero Advisory).

The root cause is that the /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the gateway's [object_storage] configuration, violating the principle of least privilege (CWE-552, CWE-918). By specifying the filesystem storage type in the storage_path payload, an attacker can direct the gateway to read arbitrary files from its local filesystem — including credential files. By specifying the s3_compatible storage type with an attacker-controlled endpoint, the gateway can be coerced into making outbound HTTP requests to internal or cloud metadata services (e.g., http://169.254.169.254), constituting a classic SSRF attack. The fix in PR #7527 (commit 0abbc83) removes caller control over the storage backend, restricting the endpoint to only fetch objects by path from the gateway's own configured object store (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to read arbitrary files from the TensorZero gateway's filesystem, potentially exposing sensitive credentials such as API keys, cloud provider secrets, or configuration files. The SSRF vector enables attackers to pivot to internal network resources or cloud instance metadata endpoints (e.g., AWS IMDSv1), which can lead to credential theft and lateral movement within cloud environments. Integrity and availability are not directly impacted, but the high confidentiality impact combined with the changed scope means a compromise of the gateway can extend to other systems and services in the environment (GitHub Advisory, TensorZero Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported at this time. The vulnerability requires low privileges (authenticated access) when authentication is enabled, but is exploitable by any unauthenticated caller when authentication is disabled — a common deployment scenario for internal or development environments. The CVE status is currently "Reserved" and no EPSS score or CISA KEV catalog entry has been identified. The vulnerability was detected by Qualys scanners (GitHub Advisory).

1. Reconnaissance: Identify TensorZero Gateway instances (pip package or Docker image tensorzero/gateway) running versions prior to 2026.6.0, accessible over the network. Check if authentication is disabled for unauthenticated access, or obtain valid credentials for authenticated deployments.
2. Target the vulnerable endpoint: Send an HTTP GET or POST request to the /internal/object_storage endpoint of the gateway.
3. Arbitrary file read (filesystem abuse): Supply a crafted JSON storage_path parameter specifying "type": "filesystem" with a path pointing to a sensitive file (e.g., /etc/passwd, application credential files, or environment variable files): {"storage_path": {"type": "filesystem", "path": "/etc/passwd"}}.
4. SSRF (s3_compatible abuse): Supply a crafted storage_path specifying "type": "s3_compatible" with an attacker-controlled endpoint pointing to an internal resource such as the AWS instance metadata service: {"storage_path": {"type": "s3_compatible", "endpoint": "http://169.254.169.254", "bucket_name": "x", "region": "us-east-1"}}.
5. Exfiltrate data: Collect the gateway's response, which will contain the contents of the targeted file or the response from the internal metadata endpoint, potentially including cloud provider credentials or IAM role tokens (GitHub Advisory, TensorZero Advisory).

• Network: Unexpected outbound HTTP requests from the TensorZero gateway process to internal IP ranges (e.g., 169.254.169.254, RFC-1918 addresses) or unusual S3-compatible endpoints not matching the configured object store.
• Logs: Gateway access logs showing requests to /internal/object_storage with storage_path parameters containing "type": "filesystem" or "type": "s3_compatible" with non-standard endpoints or local file paths; repeated or automated requests to this endpoint from unexpected source IPs.
• File System: Evidence of access to sensitive files (e.g., /etc/passwd, credential files, .env files) reflected in OS-level file access audit logs (e.g., auditd) correlating with gateway process activity.
• Process: Unusual network connections initiated by the gateway process to metadata endpoints or internal services not part of normal operation.

The vulnerability is patched in TensorZero version 2026.6.0 (both pip package and tensorzero/gateway Docker image). Upgrading to 2026.6.0 or later is the recommended remediation, as the patch (PR #7527) removes caller control over the storage backend entirely. For deployments that cannot be immediately upgraded and are exposed to untrusted callers, block all external access to the /internal/object_storage endpoint at the network or reverse proxy layer. Additionally, enabling authentication on the gateway limits exploitation to authenticated users only (TensorZero Advisory, Release 2026.6.0).