CVE-2026-110719 MEDIUM

CVE-2026-110719: Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header

Vendor Portkey-Ai
Product gateway
Weakness CWE-918 · SSRF
Published October 14, 2026
Last update October 20, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.

Key dates

02Disclosure timeline

October 14, 2026 CVE published
October 20, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-39645 WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-42641 WordPress Share This Image plugin <= 2.14 - Server Side Request Forgery (SSRF) vulnerability CVE-2025-60175 WordPress PopAd Plugin <= 1.0.4 - Server Side Request Forgery (SSRF) Vulnerability CVE-2026-39630 WordPress Getty Images plugin <= 4.1.0 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension