CVE-2026-82270: Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/*
Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/ route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal services and exfiltrate provider API keys.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it over the network. The affected route allows the attacker to supply an x-portkey-custom-host header pointing to an internal address.
What can an attacker do with a successful exploit?
The attacker can cause the gateway to forward requests to internal services. Requests may include Authorization headers, allowing provider API keys to be exfiltrated.
Which deployments are affected?
Portkey AI Gateway versions through 1.15.2 are affected. The issue is specifically associated with the /v1/proxy/* route lacking requestValidator middleware.