CVE-2026-110719: SSRF via custom host header

CISO Take

Portkey AI Gateway versions 1.14.0 through 1.15.2 contain an unauthenticated server-side request forgery flaw: when TRUSTED_CUSTOM_HOSTS is unset, the gateway trusts localhost-style hosts supplied in the x-portkey-custom-host header. An attacker can make the gateway call loopback and Docker host services and return their responses. It is rated high (CVSS 7.2, scope changed), is network-reachable with no privileges or user interaction, and a public advisory plus the vulnerable code location are available. There is no KEV listing, no known public exploit or Nuclei template, and no EPSS score yet, so exploitation likelihood is unquantified, but the low complexity makes weaponization easy. Upgrade past 1.15.2 once a fixed release is confirmed, set TRUSTED_CUSTOM_HOSTS explicitly to an allowlist, and restrict the gateway's egress to internal services and metadata endpoints.

Sources:NVDATLASvulncheck.comgithub.com/Portkey-AI/gateway

What is the risk?

High. Exploitation needs no authentication and low skill, and the changed scope means internal services outside the gateway's own trust boundary are reachable. Confidentiality and integrity impact are rated low in the CVSS vector, but real impact depends on what is bound to loopback or the Docker host (databases, admin APIs, model servers, secrets). Gateways exposed to the internet with default configuration are most at risk. No known active exploitation (not in CISA KEV, no public exploit). EPSS data is unavailable.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated /v1 request to an exposed Portkey gateway with a crafted x-portkey-custom-host header.

AML.T0049

Exploitation

isValidCustomHost accepts localhost-style hosts because TRUSTED_CUSTOM_HOSTS is unset, so the gateway issues the request to the internal target.

Discovery

Attacker probes loopback and Docker host ports to map internal services such as Ollama or admin APIs.

AML.T0075

Impact

The gateway returns internal service responses, leaking data and enabling further pivoting inside the network.

Initial Access

Attacker sends an unauthenticated /v1 request to an exposed Portkey gateway with a crafted x-portkey-custom-host header.

AML.T0049

Exploitation

isValidCustomHost accepts localhost-style hosts because TRUSTED_CUSTOM_HOSTS is unset, so the gateway issues the request to the internal target.

Discovery

Attacker probes loopback and Docker host ports to map internal services such as Ollama or admin APIs.

AML.T0075

Impact

The gateway returns internal service responses, leaking data and enabling further pivoting inside the network.

How severe is it?

CVSS 3.1

7.2 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SChanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade to a Portkey Gateway release later than 1.15.2 that fixes isValidCustomHost, once confirmed in the vendor repository. 2) Set TRUSTED_CUSTOM_HOSTS to an explicit allowlist of permitted upstream hosts. 3) Strip or reject the x-portkey-custom-host header at the reverse proxy or WAF for untrusted clients. 4) Place the gateway behind authentication and do not expose it directly to the internet. 5) Apply egress controls and network segmentation so the gateway container cannot reach loopback-bound or Docker host services, and block cloud metadata endpoints (169.254.169.254) or enforce IMDSv2. 6) Detect: alert on requests with x-portkey-custom-host values pointing to localhost, 127.0.0.0/8, host.docker.internal, private ranges or link-local addresses, and review gateway logs for unexpected upstream destinations.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassAPIInferenceFrameworkAML.T0049- Exploit Public-Facing Application AML.T0075- Cloud Service Discovery AML.T0096- AI Service API

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and vulnerability management

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-110719?

Portkey AI Gateway versions 1.14.0 through 1.15.2 contain an unauthenticated server-side request forgery flaw: when TRUSTED_CUSTOM_HOSTS is unset, the gateway trusts localhost-style hosts supplied in the x-portkey-custom-host header. An attacker can make the gateway call loopback and Docker host services and return their responses. It is rated high (CVSS 7.2, scope changed), is network-reachable with no privileges or user interaction, and a public advisory plus the vulnerable code location are available. There is no KEV listing, no known public exploit or Nuclei template, and no EPSS score yet, so exploitation likelihood is unquantified, but the low complexity makes weaponization easy. Upgrade past 1.15.2 once a fixed release is confirmed, set TRUSTED_CUSTOM_HOSTS explicitly to an allowlist, and restrict the gateway's egress to internal services and metadata endpoints.

Is CVE-2026-110719 actively exploited?

No confirmed active exploitation of CVE-2026-110719 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110719?

1) Upgrade to a Portkey Gateway release later than 1.15.2 that fixes isValidCustomHost, once confirmed in the vendor repository. 2) Set TRUSTED_CUSTOM_HOSTS to an explicit allowlist of permitted upstream hosts. 3) Strip or reject the x-portkey-custom-host header at the reverse proxy or WAF for untrusted clients. 4) Place the gateway behind authentication and do not expose it directly to the internet. 5) Apply egress controls and network segmentation so the gateway container cannot reach loopback-bound or Docker host services, and block cloud metadata endpoints (169.254.169.254) or enforce IMDSv2. 6) Detect: alert on requests with x-portkey-custom-host values pointing to localhost, 127.0.0.0/8, host.docker.internal, private ranges or link-local addresses, and review gateway logs for unexpected upstream destinations.

What systems are affected by CVE-2026-110719?

This vulnerability affects the following AI/ML architecture patterns: LLM gateways and proxies, model serving, containerized inference deployments, multi-provider LLM routing.

What is the CVSS score for CVE-2026-110719?

CVE-2026-110719 has a CVSS v3.1 base score of 7.2 (HIGH). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

LLM gateways and proxiesmodel servingcontainerized inference deploymentsmulti-provider LLM routing

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0075Cloud Service Discovery

AML.T0096AI Service API

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.

Exploitation Scenario

An attacker finds an internet-exposed Portkey gateway running 1.14.0-1.15.2 with TRUSTED_CUSTOM_HOSTS unset. They send a request to a /v1 endpoint selecting the ollama provider with x-portkey-custom-host set to http://127.0.0.1:<port> or the Docker host gateway address. The gateway makes the request from inside the network and returns the internal service's response. The attacker enumerates internal ports and services, reads data from unauthenticated admin or model-management APIs, and uses the gateway as a pivot toward further internal targets.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.