---
id: CVE-2026-54457
title: >-
  TensorZero is an open-source LLMOps platform that unifies an LLM gateway,
  observability, evaluation, optimization, and experimentation
summary: >-
  TensorZero is an open-source LLMOps platform that unifies an LLM gateway,
  observability, evaluation, optimization, and experimentation. Prior to
  2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a
  caller-supplied…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-552
  - CWE-918
vendor: tensorzero
product: tensorzero
affected:
  - tensorzero < 2026.6.0
patched:
  - tensorzero 2026.6.0
published: '2026-08-21'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T18:24:59.400'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54457'
references:
  - url: >-
      https://github.com/tensorzero/tensorzero/commit/0abbc838bae3394fe7491dad7009670d4e3b6cf8
    label: security-advisories@github.com
  - url: 'https://github.com/tensorzero/tensorzero/releases/tag/2026.6.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/tensorzero/tensorzero/security/advisories/GHSA-824w-x939-6cmc
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-824w-x939-6cmc'
tags:
  - nvd
  - ghsa
  - pip
epss: 0.00402
epssPercentile: 0.31782
aliases:
  - GHSA-824w-x939-6cmc
ecosystem: pip
ingestedAt: '2026-07-15T22:46:58.887Z'
---

## Overview

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound object-storage requests to attacker-chosen internal or cloud-metadata endpoints. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment configuration. This issue is fixed in version 2026.6.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54457)

Affected packages:

- `tensorzero < 2026.6.0`

Patched in:

- `tensorzero 2026.6.0`

Source: https://github.com/advisories/GHSA-824w-x939-6cmc