CVE-2026-110719

Portkey AI Gateway versions 1.14.0 through 1.15.2 are vulnerable to a Server-Side Request Forgery (SSRF) . The issue stems from the isValidCustomHost function, which trusts localhost-style hosts when the TRUSTED_CUSTOM_HOSTS environment variable is unset. Unauthenticated attackers can exploit thi...

EUVD-2026-101142

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...