Portkey-AI CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Portkey-AI CVE published 2026-10-14

CVE-2026-110719

CVE-2026-110719 is a server-side request forgery vulnerability in Portkey AI Gateway versions 1.14.0 through 1.15.2. The vulnerability allows unauthenticated attackers to reach loopback and Docker host services due to the isValidCustomHost function trusting localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can exploit this by sending crafted /v1 requests with an x-portkey-custom-host header.