CVE-2026-110719

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

CVE-2026-110719 Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

CVE-2026-110719

Portkey AI Gateway versions 1.14.0 through 1.15.2 are vulnerable to a Server-Side Request Forgery (SSRF) . The issue stems from the isValidCustomHost function, which trusts localhost-style hosts when the TRUSTED_CUSTOM_HOSTS environment variable is unset. Unauthenticated attackers can exploit thi...

CVE-2026-110719 Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

EUVD-2026-101142

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

PT-2026-114121

Name of the Vulnerable Software and Affected Versions Portkey AI Gateway versions 1.14.0 through 1.15.2 Description A server-side request forgery SSRF issue exists where unauthenticated attackers can access loopback and Docker host services. This occurs because the isValidCustomHost function trus...

CVE-2026-110719: Server-Side Request Forgery (SSRF)

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

Portkey Gateway server request forgery vulnerability

Portkey Gateway version 1.14.0 to 1.15.2 has a server-side request forgeing vulnerability. This vulnerability arises from the isValidCustomHost function, which trusts the localhost-style host when TRUSTEDCUSTOMHOSTS is not set. Additionally, the x-portkey-custom-host header is not validated. As a...