CVE-2026-82270

Received Received - Intake

Portkey AI Gateway Server-Side Request Forgery

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal services and exfiltrate provider API keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82270

EUVD

EUVD-2026-67801

Affected Vendors & Products

Vendor	Product	Version / Range
portkey_ai	gateway	1.15.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-82270 is a Server-Side Request Forgery (SSRF) vulnerability in Portkey AI Gateway versions up to 1.15.2. It affects the /v1/proxy/* route which lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal services and steal provider API keys.

Detection Guidance

Check if Portkey AI Gateway versions up to 1.15.2 are running. Inspect network traffic for requests to /v1/proxy/* with x-portkey-custom-host headers pointing to internal addresses. Monitor for unusual outbound requests or exfiltration of API keys.

Impact Analysis

This vulnerability allows attackers to bypass security controls and send unauthorized requests to internal systems. It can lead to theft of API keys, exposure of sensitive data, and potential compromise of internal services. Organizations using Portkey AI Gateway versions up to 1.15.2 are at risk of credential theft and unauthorized access.

Compliance Impact

The vulnerability may lead to unauthorized access to sensitive data, which could violate GDPR's data protection requirements and HIPAA's security rules for protected health information. Compromise of API keys could also result in unauthorized data processing or disclosure, potentially breaching compliance obligations.

Mitigation Strategies

Upgrade Portkey AI Gateway to a version beyond 1.15.2. Remove or disable the deprecated /v1/proxy/* route. Add requestValidator middleware to enforce allowlist checks on all proxy routes. Block or monitor requests with x-portkey-custom-host headers.

Hi! I’m here to help you understand CVE-2026-82270. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70