CVE-2026-110719
|
| |
|
|
Affected software |
DOCKER |
|
|
|
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-110719 |
