PT-2026-64141 · Pypi · Tensorzero

Publicado 2026-07-23 · Atualizado 2026-07-23

OSV

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Impact

The /internal/object storage endpoint accepts a caller-supplied JSON storage path parameter that dynamically overrides the TensorZero [object storage] configuration.

By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may contain sensitive credentials. Similarly, by abusing the s3 compatible storage type, the caller can coerce the gateway into making outbound object storage requests to attacker-chosen internal/cloud-metadata endpoints.

This vulnerability only applies when the gateway can be accessed by untrusted callers. If a developer's TensorZero deployment has authentication enabled, only authenticated callers can exploit this vulnerability. If a developer's deployment has authentication disabled, any caller can exploit this vulnerability.

Remediation

The vulnerability has been patched in version 2026.6.0. See PR #7527.

Workarounds

If developers are unable to upgrade a gateway that is exposed to untrusted callers, please block external access to the /internal/object storage endpoint.

Correção

Identificadores relacionados

PYSEC-2026-3541

Produtos afetados

Tensorzero

Referências · 8

• https://github.com/tensorzero/tensorzero/security/advisories/GHSA-824w-x939-6cmc · Nota
• https://github.com/tensorzero/tensorzero · Nota
• https://github.com/tensorzero/tensorzero/releases/tag/2026.6.0 · Nota
• https://github.com/tensorzero/tensorzero/commit/0abbc838bae3394fe7491dad7009670d4e3b6cf8 · Nota
• https://pypi.org/project/tensorzero · Nota
• https://github.com/advisories/GHSA-824w-x939-6cmc · Nota
• https://osv.dev/vulnerability/PYSEC-2026-3541 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-54457 · Nota de Segurança