SSRF Vulnerability in Portkey.ai Gateway Affects Users and Systems
CVE-2025-66405

6.9MEDIUM

Key Information:

Vendor

Portkey-ai

Status
Gateway
Vendor
CVE Published:
1 December 2025

What is CVE-2025-66405?

The Portkey.ai Gateway allows an attacker to exploit a vulnerability due to the way it determines the destination baseURL through the x-portkey-custom-host request header. This can lead to a Server-Side Request Forgery (SSRF) attack, which allows malicious users to interact with internal services and potentially exfiltrate sensitive information. Systems using versions prior to 1.14.0 are at risk and are advised to upgrade to the latest version to mitigate this threat. The issue has been addressed in version 1.14.0, reinforcing the protocol to ensure better security practices.

Affected Version(s)

gateway < 1.14.0

References

https://github.com/Portkey-AI/gateway/security/advisories...
x_refsource_CONFIRM
https://github.com/Portkey-AI/gateway/pull/1372
x_refsource_MISC
https://github.com/Portkey-AI/gateway/commit/b5a7825ba5f4...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.