CVE-2026-110719 — Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services be…
Published: 2026-10-14 · CVSS: 6.9 · CVSS 4.0
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7