CVE-2025-66405
Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host
Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF attacks. This vulnerability is fixed in 1.14.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host
Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF attacks. This vulnerability is fixed in 1.14.0.
- Record
CVE-2025-66405- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2025-200120
Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF attacks. This vulnerability is fixed in 1.14.0.
- Record
EUVD-2025-200120- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hhh5-2cvx-vmfp
Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host
Summary
The gateway determines the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF (CWE-918) attack
Impact
This vulnerability can be exploited to force the server to make requests to arbitrary hosts on the internal network. This could allow an attacker to exfiltrate sensitive data, for instance, by accessing the AWS metadata service.
Patches
The issue is patched in 1.14.0 (https://github.com/Portkey-AI/gateway/pull/1372)
The vulnerability resides within the gateway's request processing function which handles the x-portkey-custom-host header. This parameter was passed directly or with insufficient validation/sanitization to an internal HTTP request function.
The fix (v1.14.0) implements a robust allow-list policy:
-
All custom host inputs are now strictly validated to ensure the resulting URI points only to trusted, expected external services.
-
The implementation now explicitly blocks requests to non-routable IP addresses, loopback addresses, private networks and standard metadata endpoints.
Credit
This vulnerability was discovered and reported responsibly by @im-soohyun. We thank them for their adherence to coordinated vulnerability disclosure principles.
References
- Record
GHSA-hhh5-2cvx-vmfp- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-918
- Updated
- 2026-11-02
NVD
Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF attacks. This vulnerability is fixed in 1.14.0.
- Record
CVE-2025-66405- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host
Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF attacks. This vulnerability is fixed in 1.14.0.
- Record
CVE-2025-66405- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-hhh5-2cvx-vmfp
Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host
Summary
The gateway determines the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF (CWE-918) attack
Impact
This vulnerability can be exploited to force the server to make requests to arbitrary hosts on the internal network. This could allow an attacker to exfiltrate sensitive data, for instance, by accessing the AWS metadata service.
Patches
The issue is patched in 1.14.0 (https://github.com/Portkey-AI/gateway/pull/1372)
The vulnerability resides within the gateway's request processing function which handles the x-portkey-custom-host header. This parameter was passed directly or with insufficient validation/sanitization to an internal HTTP request function.
The fix (v1.14.0) implements a robust allow-list policy:
-
All custom host inputs are now strictly validated to ensure the resulting URI points only to trusted, expected external services.
-
The implementation now explicitly blocks requests to non-routable IP addresses, loopback addresses, private networks and standard metadata endpoints.
Credit
This vulnerability was discovered and reported responsibly by @im-soohyun. We thank them for their adherence to coordinated vulnerability disclosure principles.
References
- Record
GHSA-hhh5-2cvx-vmfp- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-918
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@portkey-ai/gatewaynpm |
before 1.14.0 | 1.14.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-66405 is a medium vulnerability (CVSS 6.9) in Netscaler Gateway, published December 1, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in @portkey-ai/gateway 1.14.0.
References
github.com/Portkey-AI/gateway/security/advisories/GHSA-hhh5-2cvx-vmfp
nvd.nist.gov/vuln/detail/CVE-2025-66405