{"action":"Upgrade tensorzero to 2026.6.0 or later.","affected":[{"fixed":"2026.6.0","introduced":"0"}],"component":"tensorzero","cve_ids":["CVE-2026-54457"],"ecosystem":"PyPI","epss":0.00402,"exploited":false,"fixed_versions":["2026.6.0"],"ghsa_id":"GHSA-824w-x939-6cmc","id":"tcs_01M5KF6YYKRMQKD3C6MRXDA49Q","modified_at":"2026-07-23T15:11:46.928899331Z","published_at":"2026-07-15T21:59:40Z","references":["https://osv.dev/vulnerability/GHSA-824w-x939-6cmc","https://github.com/tensorzero/tensorzero/security/advisories/GHSA-824w-x939-6cmc","https://github.com/tensorzero/tensorzero/commit/0abbc838bae3394fe7491dad7009670d4e3b6cf8","https://github.com/tensorzero/tensorzero","https://github.com/tensorzero/tensorzero/releases/tag/2026.6.0"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-824w-x939-6cmc","url":"https://osv.dev/vulnerability/GHSA-824w-x939-6cmc"}],"summary":"TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint"}