Portkey-AI vulnerabilities
We track 3 vulnerabilities in Portkey-AI products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest Portkey-AI vulnerabilities
- 7.2 High severity
gateway: Server-Side Request Forgery
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is u
- 7.5 High severity
gateway: Server-Side Request Forgery
Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authoriza
- 9.8 Critical severity
gateway: Server-Side Request Forgery
Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified