Attack Chain

1. An attacker identifies a TensorZero Gateway instance with an accessible /internal/object_storage endpoint.
2. The attacker constructs a malicious JSON payload designed to manipulate the storage_path parameter.
3. To achieve arbitrary file reading, the attacker sets the JSON storage_type to filesystem and specifies a local file path (e.g., /etc/passwd).
4. The attacker sends an HTTP POST request to the /internal/object_storage endpoint with the crafted JSON payload, potentially URL-encoded, as a parameter or in the request body.
5. The vulnerable TensorZero Gateway processes the request, overriding its object storage configuration and reading the specified local file.
6. The gateway returns the content of the arbitrary file in its response, completing the arbitrary file read.
7. Alternatively, to perform Server-Side Request Forgery (SSRF), the attacker sets the JSON storage_type to s3_compatible and specifies an internal IP address or a cloud-metadata endpoint URL (e.g., http://169.254.169.254/latest/meta-data/).
8. The gateway is coerced into making an outbound request to the attacker-controlled endpoint, returning the response which could contain internal network information or cloud credentials.

Impact

Successful exploitation of CVE-2026-54457 allows attackers to read arbitrary files from the TensorZero Gateway's filesystem, potentially exposing sensitive configuration files, system credentials, or other confidential data. The Server-Side Request Forgery (SSRF) capability further enables attackers to perform internal network reconnaissance, access internal services, and exfiltrate cloud metadata, such as AWS IAM role credentials, which can lead to broader cloud resource compromise. While the vulnerability requires authentication if enabled, unauthenticated access is possible if the gateway's authentication is disabled, significantly broadening the attack surface. This could lead to a complete compromise of the gateway and further lateral movement within an organization's network or cloud environment. The vulnerability has been patched in version 2026.6.0.

Recommendation

• Patch CVE-2026-54457 immediately by upgrading TensorZero Gateway to version 2026.6.0 or later to remediate the vulnerability.
• If immediate upgrade is not possible for a gateway exposed to untrusted callers, block external access to the /internal/object_storage endpoint at the network perimeter.
• Deploy the provided Sigma rule to detect exploitation attempts against this vulnerability in your web server logs.
• Ensure web server logs are configured to capture full HTTP POST request bodies for the /internal/object_storage endpoint to improve detection fidelity against this type of exploitation.