gateway vulnerabilities

3 known vulnerabilities in gateway from Portkey-AI. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  gateway: Server-Side Request Forgery

  CVE-2026-110719Oct 14, 2026Portkey-AI

  Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is u

• 7.5 High severity

  gateway: Server-Side Request Forgery

  CVE-2026-82270Aug 28, 2026Portkey-AI

  Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authoriza

• 9.8 Critical severity

  gateway: Server-Side Request Forgery

  CVE-2025-66405Dec 1, 2025Portkey-AI

  Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified