Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorzero | pip | < 2026.6.0 | 2026.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability was an arbitrary file read and Server-Side Request Forgery (SSRF) in the TensorZero Gateway's /internal/object_storage endpoint. The root cause was that the endpoint accepted a storage_path query parameter which was a user-controlled JSON string. This string was deserialized into a StoragePath object, allowing an attacker to define the storage backend on-the-fly. By specifying a filesystem backend, an attacker could read arbitrary files on the gateway's filesystem. By specifying an s3_compatible backend with a custom endpoint, an attacker could coerce the gateway into making requests to internal network services or cloud metadata endpoints, constituting an SSRF attack.
The primary vulnerable function was tensorzero_core::endpoints::object_storage::get_object_handler, which processed the malicious input. The patch remediates this by fundamentally changing the endpoint's behavior. It no longer accepts a user-defined storage configuration. Instead, it only accepts a relative path string and uses the gateway's own, pre-configured object store to fetch the data. Additionally, it now properly validates the path to prevent directory traversal attacks as a defense-in-depth measure. The tensorzero_core::client::Client::get_object function was also updated to align with this new, safer API.
tensorzero_core::endpoints::object_storage::get_object_handlercrates/tensorzero-core/src/endpoints/object_storage.rs
tensorzero_core::client::Client::get_objectcrates/tensorzero-core/src/client/mod.rs