Skip to content
CVE-2026-110719: SSRF Vulnerability in Portkey AI Gateway

CVE-2026-110719: SSRF Vulnerability in Portkey AI Gateway

First seen 15 Oct 2026, 11:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 15, 2026 at 12:33 UTC
  • •Portkey AI Gateway versions 1.14.0 to 1.15.2 are vulnerable to SSRF.
  • •The vulnerability allows unauthenticated access to internal services via crafted requests.
  • •Immediate remediation is advised for internet-facing deployments.

Portkey AI Gateway versions 1.14.0 to 1.15.2 contain a server-side request forgery (SSRF) vulnerability, CVE-2026-110719, allowing unauthenticated attackers to access internal services via crafted requests. The vulnerability arises because the gateway trusts localhost-style hosts when the TRUSTED_CUSTOM_HOSTS setting is unset. Attackers can exploit this flaw by sending requests with a specific x-portkey-custom-host header, enabling them to relay responses from internal services. The risk is particularly high for internet-exposed deployments, especially in containerized environments. No has been confirmed, but the vulnerability is rated as medium severity with a CVSS score of 6.9. Organizations are advised to upgrade to fixed versions and restrict network access to the gateway until then.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-14
CVE-2026-110719 published
The vulnerability was officially published with a CVSS score of 6.9, indicating medium severity.
Redpacketsecurity

More articles in this cluster (4)

Following this threat?

Track CVE-2026-110719 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 4

Common questions

What versions of Portkey AI Gateway are affected?
Versions 1.14.0 through 1.15.2 are affected by CVE-2026-110719.
Is there any active exploitation reported?
No active exploitation has been confirmed for this vulnerability.
What should organizations do to mitigate this risk?
Organizations should upgrade to a fixed version and restrict network access to the gateway until the upgrade is completed.