CVE-2025-66405 is a server-side request forgery in the Portkey.ai Gateway. The gateway picks its destination from the x-portkey-custom-host request header and appends the client path, so a caller can steer requests to internal hosts. Fixed in 1.14.0. The record scores it 9.8, the advisory says Moderate.
What's affected
- Product: Portkey.ai Gateway, an AI gateway with guardrails.
- Affected: versions before 1.14.0.
- Fixed: 1.14.0 (pull request 1372).
- Trigger: the proxy route uses the x-portkey-custom-host header value as the base URL for an outbound fetch.
Severity differs by source. The record gives CVSS 9.8 (critical) with no privileges needed. The vendor advisory labels it Moderate. The impact depends on what your gateway host can reach, which is why the two views differ.
How to check if you're exposed
Find the version of the gateway you run. For a container, look at the image tag. For a Node deployment, check the installed package version.
docker ps --format "table {{.Names}}\t{{.Image}}"
npm ls --all | grep -i portkey
If it is below 1.14.0, you are affected. Then check where the gateway runs. If it is on a cloud instance or inside a cluster, list what it can reach: internal admin services, databases, and the cloud metadata address, which the advisory names as an example.
What to do now
- Upgrade to Portkey Gateway 1.14.0 or later.
- Restrict egress from the gateway host or pod. Block access to private ranges, loopback and the cloud metadata endpoint unless something requires it.
- Require authentication in front of the gateway and do not expose it directly to the internet if clients do not need it.
- Review gateway logs for requests with unusual custom host header values.
- On cloud hosts, use the stronger metadata service settings your provider offers.
Why it matters
The advisory explains that the custom host value was passed to an internal HTTP request function with insufficient validation. That is CWE-918, server-side request forgery: the server makes a request to a place the caller chose. The impact can include reading data from internal services that trust requests from inside the network, such as the cloud metadata service.
The fix is described as an allow list approach. Custom hosts are validated so they point only at expected external services, and non-routable addresses, loopback, private networks and standard metadata endpoints are blocked. AI gateways sit between your apps and many providers, so they hold keys and have broad network reach. The record does not list exploitation in the wild, and the CVE is not on CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why would a custom host header be a problem?
Because the gateway uses it to decide where to send a request, a caller who controls it can point the gateway at hosts the caller could not reach directly.
Is upgrading enough?
Upgrading removes the flaw. Egress filtering is a good second layer for any service that fetches URLs.
Sources
Last reviewed: 18 October 2026.
