The gateway processes an X-Portkey-Custom-Host header without proper validation. An attacker who can send an arbitrary header to any /v1 endpoint can force the server to fetch resources from loopback or Docker host addresses, exposing internal network services without authentication. This flaw enables enumeration, data exfiltration, or further attacks against services reachable only from the host.

Portkey- AI gateway versions 1.14.0 through 1.15.2 are affected. The vulnerability exists because the isValidCustomHost routine treats localhost-style hosts as trusted when the TRUSTED_CUSTOM_HOSTS environment variable is not set.

The CVSS score is 6.9, indicating a moderate severity. The EPSS score indicates a very low likelihood of exploitation (<1%), and the vulnerability is not listed in CISA KEV. Attackers can exploit it over an unauthenticated HTTP connection by sending a crafted request to any endpoint, making the gateway reach internal resources and return their responses. The lack of authentication and the direct request forging make exploitation straightforward if the gateway is exposed to the network.