Portkey Ai Gateway 1.14.0 Through 1.15.2 Ssrf Via X Portkey Custom Host Header

Back www.vulncheck.com

Portkey Ai Gateway 1.14.0 Through 1.15.2 Ssrf Via X Portkey Custom Host Header

www.vulncheck.com • October 15, 2026

Share: View original

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-110719: SSRF Vulnerability in Portkey AI Gateway Portkey AI Gateway versions 1.14.0 to 1.15.2 contain a server-side request forgery (SSRF) vulnerability, CVE-2026-110719, allowing unauthenticated attackers to access internal services via crafted requests. The vulnerability arises because the gateway trusts localhost-style hosts when the TRUSTED_CUSTOM_HOSTS setting is unset. Attackers can exploit this flaw by sending requests with a specific x-portkey-custom-host header, enabling them to relay responses from internal services. The risk is particularly high for internet-exposed deployments, especially in containerized environments. No has been confirmed, but the vulnerability is rated as medium severity with a CVSS score of 6.9. Organizations are advised to upgrade to fixed versions and restrict network access to the gateway until then. 1 sources 46

Extracted Entities

Attack Types (1)

Zero-day Exploit

CWE Weaknesses (1)

CWE-918 - Server-Side Request Forgery (ssrf)