GHSA-824w-x939-6cmc

Suggest an improvement
Source
https://github.com/advisories/GHSA-824w-x939-6cmc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-824w-x939-6cmc/GHSA-824w-x939-6cmc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-824w-x939-6cmc
Aliases
Published
2026-07-15T21:59:40Z
Modified
2026-07-23T15:11:46Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint
Details

Impact

The /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the TensorZero [object_storage] configuration.

By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may contain sensitive credentials. Similarly, by abusing the s3_compatible storage type, the caller can coerce the gateway into making outbound object storage requests to attacker-chosen internal/cloud-metadata endpoints.

This vulnerability only applies when the gateway can be accessed by untrusted callers. If a developer's TensorZero deployment has authentication enabled, only authenticated callers can exploit this vulnerability. If a developer's deployment has authentication disabled, any caller can exploit this vulnerability.

Remediation

The vulnerability has been patched in version 2026.6.0. See PR #7527.

Workarounds

If developers are unable to upgrade a gateway that is exposed to untrusted callers, please block external access to the /internal/object_storage endpoint.

Database specific 
{
    "cwe_ids":  [
        "CWE-552",
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-15T21:59:40Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

PyPI / tensorzero

Package

Name
tensorzero
View open source insights on deps.dev
Purl
pkg:pypi/tensorzero

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2026.6.0

Affected versions

2025.*
2025.6.0
2025.6.1
2025.6.2
2025.6.3
2025.7.0
2025.7.1
2025.7.2
2025.7.3
2025.7.4
2025.7.5
2025.8.0
2025.8.1
2025.8.2
2025.8.3
2025.8.4
2025.8.5
2025.9.0
2025.9.1
2025.9.3
2025.9.4
2025.9.5
2025.9.6
2025.10.0
2025.10.1
2025.10.2
2025.10.3
2025.10.4
2025.10.5
2025.10.6
2025.10.7
2025.10.9
2025.11.0
2025.11.1
2025.11.2
2025.11.3
2025.11.4
2025.11.5
2025.11.6
2025.12.0
2025.12.1
2025.12.2
2025.12.3
2025.12.5
2025.12.6
2026.*
2026.1.0
2026.1.1
2026.1.2
2026.1.5
2026.1.6
2026.1.7
2026.1.8
2026.2.0
2026.2.1
2026.2.2
2026.3.0
2026.3.1
2026.3.2
2026.3.3
2026.3.4
2026.4.0
2026.4.1
2026.5.0
2026.5.1
2026.5.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-824w-x939-6cmc/GHSA-824w-x939-6cmc.json"