CVE-2026-54457 in TensorZero's gateway exposes an SSRF vector that goes well beyond the typical file-read vulnerability. The /internal/object_storage endpoint accepts a caller-supplied storage_path parameter that dynamically reconfigures the outbound storage backend—this isn't a parsing flaw or URL manipulation, it's a complete architectural override of where the application's S3 client connects. When you point it at a cloud metadata endpoint (169.254.169.254 on AWS, metadata.google.internal on GCP), the gateway's own S3 client initiates the connection, making the traffic look legitimate to monitoring systems that expect object storage traffic from that workload.
The file-read vector is constrained by the gateway's filesystem permissions, but the SSRF vector is architecturally unbounded. Any TensorZero instance running in a cloud environment with an IAM role attached can have its instance credentials exfiltred through the metadata service. The 6-hour default token lifetime on AWS creates a temporal window that static scans miss but container compromise chains can exploit—particularly in ephemeral workloads where token rotation happens frequently, resetting the exploitation window each time.
Two things to verify immediately. First, check whether /internal endpoints are exposed in your deployment—if the gateway is reachable without authentication, this vulnerability is directly exploitable. Second, confirm whether the storage_path parameter is actually used in your configuration; if it's not, the safest posture is to disable object_storage routing entirely rather than rely on input validation alone.
The 'authenticated or unauthenticated depending on deployment' language in the advisory is a red flag—it signals the default configuration may be unsafe. Audit your gateway's network exposure and treat the 'internal' namespace as untrusted unless you've explicitly enforced authentication at the proxy or ingress layer.