CVE-2026-110719
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.
Risk Assessment
An attacker could access internal services and disclose sensitive information or perform unauthorized actions within the internal network.
Recommendation
Update Portkey AI Gateway to a version later than 1.15.2 or configure TRUSTED_CUSTOM_HOSTS to restrict trust to localhost-style hosts.
Other vulnerabilities in Portkey AI Gateway
Original NVD description (English source)
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS