CVE-2026-110719: Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Portkey AI Gateway versions 1.14.0 through 1.15.2 are exposed when TRUSTED_CUSTOM_HOSTS is unset, because localhost-style custom hosts are trusted in that configuration.
What does an attacker need to exploit this issue?
An attacker needs network access to the gateway and can exploit the issue without authentication or user interaction by sending a /v1 request with a crafted x-portkey-custom-host header. The ollama provider is cited as one route for triggering the outbound request.
What internal resources can be reached?
The issue allows requests to loopback services and Docker host services reachable from the gateway. Responses from those internal services can be returned through the gateway.
What mitigation is indicated if an upgrade is not immediately possible?
Configure TRUSTED_CUSTOM_HOSTS rather than leaving it unset, so localhost-style hosts are not implicitly trusted.