CVE-2026-54457

HIGH 7.7

TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

0th

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound object-storage requests to attacker-chosen internal or cloud-metadata endpoints. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment configuration. This issue is fixed in version 2026.6.0.

CWE	CWE-552 CWE-918
Vendor	tensorzero
Product	tensorzero
Published	Aug 21, 2026

Stay Ahead of the Next One

Get instant alerts for tensorzero tensorzero

Be the first to know when new high vulnerabilities affecting tensorzero tensorzero are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

tensorzero / tensorzero

< 2026.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/tensorzero/tensorzero/security/advisories/GHSA-824w-x939-6cmc github.com: https://github.com/tensorzero/tensorzero/commit/0abbc838bae3394fe7491dad7009670d4e3b6cf8 github.com: https://github.com/tensorzero/tensorzero/releases/tag/2026.6.0