Description

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal services and exfiltrate provider API keys.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T20:20:17.797Z",
  "pubdate": "2026-08-28T20:20:17.797Z",
  "executiveSummary": "Portkey AI Gateway versions through 1.15.2 are susceptible to a critical Server-Side Request Forgery (SSRF) vulnerability. The flaw exists within the /v1/proxy/* routing logic due to the omission of the requestValidator middleware.\nThis vulnerability allows unauthenticated remote attackers to bypass security controls and force the gateway to perform arbitrary HTTP requests to internal network resources. By manipulating the 'x-portkey-custom-host' header, an attacker can redirect outbound traffic to internal-only endpoints or services.\nThe primary risk involves the unauthorized exfiltration of sensitive information, specifically provider API keys and internal service credentials, as the gateway may include authorization headers in the forwarded requests. The lack of validation permits the weaponization of the gateway as a proxy to probe internal infrastructure, potentially leading to unauthorized access to downstream systems that rely on the gateway's network positioning. This vulnerability represents a significant threat to internal service confidentiality and overall perimeter integrity.",
  "technicalDetails": "The root cause of this vulnerability is an architectural oversight in the request handling pipeline for the /v1/proxy/* route. The application fails to apply the mandatory requestValidator middleware, which is intended to sanitize and validate incoming request parameters before processing. Consequently, the gateway treats user-supplied headers as trusted input.\nThe attack vector leverages the 'x-portkey-custom-host' header, which the gateway uses to resolve the destination for proxied API requests. Because the validator is absent, the backend component trustingly accepts this header value without checking for internal IP addresses (e.g., 127.0.0.1, 169.254.169.254, or private RFC 1918 addresses).\nThe attack flow proceeds as follows: 1. An attacker crafts a malicious HTTP request directed at the /v1/proxy/* endpoint. 2. The attacker injects the 'x-portkey-custom-host' header with an internal target address. 3. The gateway, lacking middleware protection, forwards the request to the specified internal target. 4. Critically, the gateway may include existing 'Authorization' headers or internal credentials intended for the original target, allowing the attacker to perform actions with the identity of the gateway service.\nThis allows for blind or semi-blind SSRF, where attackers can reach internal metadata services or management interfaces that are otherwise unreachable from the public internet. By exfiltrating provider API keys, an attacker can gain persistent unauthorized access to external LLM providers or internal backend infrastructure that trusts the gateway's egress point. The vulnerability affects all versions of the Portkey AI Gateway through 1.15.2. No authentication is required for an attacker to reach the vulnerable route, effectively bypassing external security boundaries. Post-exploitation impact ranges from internal network reconnaissance to full credential theft and service compromise."
}