EUVD-2026-101142
GHSA-h36v-27jx-93r3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed gateway /v1 endpoint
-
DeliveryCraft x-portkey-custom-host header to loopback/Docker host
-
ExploitBypass isValidCustomHost localhost trust
-
ExecutionGateway forwards request to internal service
-
ImpactInternal response reflected to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable when the Portkey AI Gateway (versions 1.14.0 through 1.15.2) runs with the TRUSTED_CUSTOM_HOSTS environment variable UNSET - which is the default state - causing isValidCustomHost to trust localhost-style/loopback hosts. The attacker sends an unauthenticated /v1 request bearing a crafted x-portkey-custom-host header (for example through the ollama provider) targeting 127.0.0.1, the Docker host gateway, or other container-local addresses. Limiting factors: the attacker must be able to reach the gateway's API endpoint over the network, impact is confined to services reachable from the gateway host (loopback and Docker host), and setting TRUSTED_CUSTOM_HOSTS to an explicit allowlist mitigates the issue; no code execution or availability impact is implied. |
| Impact | This is a moderate, config-default-exposed SSRF (CWE-918) in Portkey AI Gateway 1.14.0-1.15.2. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the description agree: exploitation is remote, unauthenticated, low-complexity, and works against the default configuration because isValidCustomHost trusts localhost-style hosts whenever TRUSTED_CUSTOM_HOSTS is unset - so these signals are mutually consistent, not conflicting. Publicly available exploit code exists (VulnCheck advisory plus a HackMD write-up), which raises practical risk above the 6.9 base score, but there is NO CISA KEV listing and NO EPSS value in the provided data, so there is no evidence of active, widespread exploitation at this time. The real-world impact is bounded: the 4.0 impact metrics are only VC:L/VI:L/SC:L/SI:L (low confidentiality/integrity on both the vulnerable and a subsequent internal system, no availability impact), meaning an attacker reaches loopback and Docker-host services and reflects their responses rather than achieving code execution or full data compromise. Net: a credible, patch-worthy priority for anyone running an exposed Portkey gateway with default host-trust settings, but not a drop-everything critical - the limited technical impact and absence of KEV/EPSS signals argue against mass-exploitation urgency. |
| Exploit ScenarioDerived | An attacker who can reach an internet- or network-exposed Portkey AI Gateway (running 1.14.0-1.15.2 with TRUSTED_CUSTOM_HOSTS unset) sends a /v1 API request using the ollama provider and a crafted x-portkey-custom-host header pointing at a loopback or Docker-host address. The gateway trusts the localhost-style host, forwards the request to the internal service, and returns the internal response to the attacker, exposing metadata endpoints, admin panels, or other container-local services. Working exploit code is publicly available (VulnCheck advisory and HackMD proof-of-concept). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Server-side request forgery in Portkey AI Gateway 1.14.0 through 1.15.2 lets unauthenticated remote attackers make the gateway issue requests to loopback and Docker host services and return the responses to the caller. The flaw exists because the isValidCustomHost check trusts localhost-style hostnames whenever the TRUSTED_CUSTOM_HOSTS environment variable is unset, which is the default configuration; an attacker only needs to send a /v1 request carrying a crafted x-portkey-custom-host header (for example via the ollama provider). Publicly available exploit code exists for this issue and it is not listed in CISA KEV, so exploitation activity is not confirmed; the assessed impact is limited to confidentiality and integrity of services reachable from the gateway host, with no availability or code-execution impact.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary immediate action is configuration hardening: set the TRUSTED_CUSTOM_HOSTS environment variable to an explicit allowlist of the legitimate upstream provider hosts your deployment actually uses, which directly disables the trust of localhost-style hosts and blocks the attack path (the trade-off is that any custom/self-hosted provider endpoint not on the allowlist will stop working until it is added). Additionally, because the exploit hinges on attacker-controlled x-portkey-custom-host headers reaching the /v1 API, restrict network access to the gateway's API port to trusted clients only and place it behind authentication or a reverse proxy/API gateway that strips or validates that header, understanding that this reduces exposure but does not fix the underlying validation logic. If the gateway is containerized, avoid running it on the Docker host network and isolate it so loopback and host-gateway addresses do not expose sensitive internal services; this limits blast radius but is not a substitute for the allowlist. Track the upstream project at https://github.com/Portkey-AI/gateway and the advisory at https://www.vulncheck.com/advisories/portkey-ai-gateway-1.14.0-through-1.15.2-ssrf-via-x-portkey-custom-host-header for a fixed release, and upgrade as soon as one is published, since publicly available exploit code exists and exploitation is a single unauthenticated request.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-918 server-side request forgery rooted in request validation logic within Portkey AI Gateway, an AI/LLM routing proxy that lets clients select upstream providers such as ollama, OpenAI, and others. The vulnerable code lives in the requestValidator middleware (src/middlewares/requestValidator/index.ts, around line 289), where the isValidCustomHost function decides whether a client-supplied custom host is acceptable. When the TRUSTED_CUSTOM_HOSTS environment variable is not configured - the default state of the shipped container image - the function treats localhost-style hostnames as trusted, so the gateway will happily proxy to 127.0.0.1 and to the Docker host gateway address. Because the gateway's whole purpose is to forward requests to a caller-specified provider endpoint and return the upstream response, a successful SSRF yields the internal service's response body directly to the attacker. The CPE cpe:2.3:a:portkey-ai:gateway identifies the affected package across the 1.14.x and 1.15.x lines. The attack surface is the network-exposed /v1 API, and per the CVSS 4.0 vector AV:N/PR:N/UI:N no authentication or user interaction is required; scope is changed (S:C) since the gateway becomes a pivot into other services on the same host or Docker network.
Know when Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Remote unauthenticated request against default config (AV:N/AC:L/PR:N/UI:N); SSRF pivots to a separate internal system so S:C, with limited read/write of internal responses (C:L/I:L) and no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the c
Unauthenticated command execution in Citrix NetScaler ADC (before 14.1-73.37, before 13.1-64.23, and the corresponding F
A remote, unauthenticated attacker can cause a denial-of-service condition on NetScaler ADC and NetScaler Gateway applia
An insufficient input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway when configured as a
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos An
HTTP request smuggling (CWE-444) in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated, remote attackers
Predictable value generation in Citrix NetScaler ADC and Gateway (CWE-342) lets unauthenticated remote attackers predict
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsis
Remote unauthenticated attackers can trigger a memory overflow in Citrix NetScaler ADC and Gateway, leading to unpredict
A memory overflow in Citrix NetScaler ADC and NetScaler Gateway can be triggered by unauthenticated remote attackers (CV
Exploit-DB