CVE-2026-110719

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

CVE-2026-110719

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

CVE-2026-110719 Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

CVE-2026-110719

Portkey AI Gateway versions 1.14.0 through 1.15.2 are vulnerable to a Server-Side Request Forgery (SSRF) . The issue stems from the isValidCustomHost function, which trusts localhost-style hosts when the TRUSTED_CUSTOM_HOSTS environment variable is unset. Unauthenticated attackers can exploit thi...

EUVD-2026-101142

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

CVE-2026-110719 Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

CVE-2026-110719 Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

PT-2026-114121

Name of the Vulnerable Software and Affected Versions Portkey AI Gateway versions 1.14.0 through 1.15.2 Description A server-side request forgery SSRF issue exists where unauthenticated attackers can access loopback and Docker host services. This occurs because the isValidCustomHost function trus...

CVE-2026-110719: Server-Side Request Forgery (SSRF)

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

CVE-2026-82270

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

CVE-2026-82270 Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/*

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

EUVD-2026-67801

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

CVE-2026-82270 Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/*

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

CVE-2026-82270 Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/*

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

CVE-2026-82270

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

CVE-2026-82270

Portkey AI Gateway through version 1.15.2 contains a Server-Side Request Forgery (SSRF) vulnerability in the /v1/proxy/* route. The root cause is the absence of the requestValidator middleware on that endpoint. An unauthenticated attacker can set the x-portkey-custom-host header to an internal ad...

PT-2026-83293

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

CVE-2026-82270: Server-Side Request Forgery (SSRF)

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal service...

Portkey AI Detection

Detected Portkey AI interface. Portkey was an AI gateway that provided observability, governance, and reliability for LLM applications. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Portkey AI interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

CVE-2025-66405 Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host

Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch...