{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ai-gateway-1.14.0-1.15.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:portkey_ai:ai_gateway:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-110719"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AI Gateway (1.14.0-1.15.2)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","ssrf","cloud"],"_cs_type":"advisory","_cs_vendors":["Portkey AI"],"content_html":"\u003cp\u003ePortkey AI Gateway versions 1.14.0 through 1.15.2 contain a server-side request forgery (SSRF) vulnerability due to improper host validation logic within the \u003ccode\u003eisValidCustomHost\u003c/code\u003e function. When the \u003ccode\u003eTRUSTED_CUSTOM_HOSTS\u003c/code\u003e configuration variable is left unset, the application incorrectly trusts localhost-style hostnames. An unauthenticated attacker can exploit this flaw by sending a crafted HTTP request to a \u003ccode\u003e/v1\u003c/code\u003e endpoint, specifically utilizing the \u003ccode\u003ex-portkey-custom-host\u003c/code\u003e header. By targeting loopback addresses or internal Docker host services through this header, an attacker can coerce the gateway to perform unauthorized requests on their behalf and return the resulting data from internal services back to the attacker. This vulnerability poses a significant risk to the confidentiality and integrity of internal infrastructure that is otherwise not exposed to the public internet.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to interact with internal services that are only accessible from the loopback interface or within the Docker environment where the AI Gateway is hosted. This can lead to unauthorized information disclosure, interaction with internal management APIs, or potential secondary exploitation of internal microservices that assume all incoming requests are originating from trusted internal sources.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Portkey AI Gateway to a version beyond 1.15.2 immediately.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, explicitly configure the \u003ccode\u003eTRUSTED_CUSTOM_HOSTS\u003c/code\u003e environment variable to restrict the gateway to a strict allowlist of known-safe, non-internal hostnames.\u003c/li\u003e\n\u003cli\u003eAudit access logs for requests containing the \u003ccode\u003ex-portkey-custom-host\u003c/code\u003e header to identify potential exploitation attempts directed at internal loopback (127.0.0.1) or private Docker host IP addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:40:43Z","date_published":"2026-10-14T16:40:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-portkey-ai-ssrf/","summary":"Portkey AI Gateway versions 1.14.0 through 1.15.2 are vulnerable to unauthenticated SSRF via the x-portkey-custom-host header, allowing attackers to access internal loopback and Docker host services.","title":"SSRF in Portkey AI Gateway","url":"https://feed.craftedsignal.io/briefs/2026-10-portkey-ai-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - AI Gateway (1.14.0-1.15.2)","version":"https://jsonfeed.org/version/1.1"}