CVE-2026-82270 | BDVDB-2026-366199 Detail

Description#

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal services and exfiltrate provider API keys.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-28Record published in the CVE List.
2. Version 22026-09-24Most recent update recorded in the CVE List.