CVE-2026-110719
Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.
| CWE | CWE-918 |
| Vendor | portkey-ai |
| Product | gateway |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for portkey-ai gateway
Be the first to know when new high vulnerabilities affecting portkey-ai gateway are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Portkey-AI / gateway
1.14.0 ≤ 1.15.2
References
hackmd.io: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/BJypv-aiMg github.com: https://github.com/Portkey-AI/gateway/blob/ca7712947ec8c0887803990b746740d36011c697/src/middlewares/requestValidator/index.ts#L289 github.com: https://github.com/Portkey-AI/gateway vulncheck.com: https://www.vulncheck.com/advisories/portkey-ai-gateway-1.14.0-through-1.15.2-ssrf-via-x-portkey-custom-host-header
Credits
hieuPenguinnn