What happened
Verified via NVD REST API (published 2026-10-14, CVSS 7.2 v3.1 / 6.9 v4.0). The gateway's custom-host allowlisting fails closed only when TRUSTED_CUSTOM_HOSTS is set; otherwise localhost-style hosts are trusted by default, letting unauthenticated requests reach internal HTTP services with the gateway's privileges.
Why it matters
An AI gateway is the trusted proxy that holds provider API keys and internal network position; SSRF from the gateway can be used to read internal services and, in containerized deployments, reach the Docker host network and cloud metadata — a stepping stone from 'reachable gateway' to internal AI infrastructure and credential material. Set TRUSTED_CUSTOM_HOSTS explicitly and restrict the gateway's egress.
Attack vector
Unauthenticated /v1 requests with a crafted x-portkey-custom-host header (e.g. via the ollama provider) reach the SSRF filter: isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset, so an attacker makes the gateway fetch loopback and Docker-host services and reflect their responses (CWE-918).
Affected systems
@portkey-ai/gateway 1.14.0 through 1.15.2
Mitigation
Upgrade beyond 1.15.2 to a fixed build; set TRUSTED_CUSTOM_HOSTS to an explicit allowlist (never unset); restrict outbound egress and place the gateway behind network controls. VulnCheck advisory + hackmd writeup.