TensorZero is an open‑source LLMOps platform. The /internal/object_storage endpoint accepts a caller‑supplied JSON storage_path parameter that can override the [object_storage] configuration. When the filesystem storage type is selected, an attacker can read arbitrary files from the gateway’s filesystem, including credential files. When the s3_compatible type is selected, the endpoint can send outbound object‑storage requests to attacker‑chosen internal or cloud‑metadata endpoints, enabling server‑side request forgery. The flaw is essentially a path traversal and SSRF vulnerability, matching CWE‑552 and CWE‑918. The primary impact is the disclosure of sensitive data located on the server or reachable via internal metadata services. If credential files are read, attackers could use them for further compromise, such as accessing other systems or services. Exploitation requires access to the gateway; the endpoint may be authenticated or unauthenticated based on deployment configuration, so a publicly exposed gateway can be attacked directly.

TensorZero by TensorZero implements the affected functionality in all releases prior to version 2026.6.0. The vulnerability is present in the TensorZero Gateway component that exposes the /internal/object_storage endpoint. No specific sub‑versions or module names beyond the main gateway are listed; the fix is applied in release 2026.6.0.

The CVSS base score of 7.7 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely network‑based, targeting the gateway endpoint. In environments where the endpoint is unauthenticated or exposed to untrusted users, an attacker can read any file that the gateway process can access and can force the application to query internal services, potentially leaking internal infrastructure details. In protected or restricted networks, the risk remains significant but is limited to the scope of the deployment.