CVE-2026-82270
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal services and exfiltrate provider API keys.
Risk Assessment
The risk includes unauthorized access to internal network resources and leakage of sensitive API keys, potentially leading to data and service compromise.
Recommendation
It is recommended to immediately upgrade Portkey AI Gateway to the latest patched version and implement request validation for proxy routes to block access to internal addresses.
Other vulnerabilities in Portkey AI Gateway
Original NVD description (English source)
Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal services and exfiltrate provider API keys.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS