CVE-2026-110719 is a High severity (CVSS 7.2) server-side request forgery in Portkey AI Gateway 1.14.0 through 1.15.2. An unauthenticated request can make the gateway call loopback and Docker host services. We could not confirm a fixed version, so set TRUSTED_CUSTOM_HOSTS.
What's affected
The record says Portkey AI Gateway 1.14.0 through 1.15.2 is affected. VulnCheck gives the same range. Neither names a fixed release, so we do not state one. Check the Portkey-AI/gateway repository for a newer release.
The weakness is CWE-918, server-side request forgery. Per the record, the function isValidCustomHost trusts localhost style hosts when the TRUSTED_CUSTOM_HOSTS setting is not set. A request to a /v1 route with a crafted x-portkey-custom-host header, for example with the ollama provider, can then make the gateway call internal services and return what they answer.
Severity differs by source. The record gives 7.2 (High) with a changed scope. VulnCheck lists 6.9 (Medium) on a CVSS 4.0 vector. We follow the record in the title, and both sources agree the issue needs no login.
How to check if you're exposed
Check the version of the gateway you run.
npm ls -g | grep -i portkey
If you run it as a container, check the image tag. Versions 1.14.0 through 1.15.2 are in range. Then check the environment of the process or container for the variable.
env | grep TRUSTED_CUSTOM_HOSTS
If it is empty, the record says localhost style hosts are trusted. Check whether the gateway port is reachable from outside, and whether the host runs other services on loopback or on the Docker host address, such as databases, model servers or admin interfaces. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Set TRUSTED_CUSTOM_HOSTS to an explicit list of the custom hosts you really use.
- Do not expose the gateway directly to the internet. Put authentication in front of it.
- Block outbound requests from the gateway to loopback, link-local and private ranges that it does not need, using container or host firewall rules.
- Check the repository for a fixed release, and upgrade once you have confirmed one.
- Review logs for requests that set the custom host header to unusual values.
Why it matters
AI gateways sit between your applications and many model providers, and some let callers name a custom provider host. That feature is a classic setup for server-side request forgery. The gateway makes the call from inside your network, where it can reach services that were never meant to be public.
The safest defaults deny first and allow by list. Here the unset state trusts local hosts, so a default install is exposed until someone configures the list. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
What setting reduces the risk?
TRUSTED_CUSTOM_HOSTS. The record says localhost style hosts are trusted when it is not set, so define it explicitly.
Does the attacker need an account?
The record says unauthenticated attackers can send the request.
Sources
Last reviewed: 18 October 2026.
