Quick answers
- Is CVE-2026-82270 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82270 being exploited in the wild.
- How severe is CVE-2026-82270?
- High severity, with a CVSS score of 7.5, published 28 August 2026.
- Which products and versions are affected?
- Portkey AI Gateway through 1.15.2.
- Is there a fix for CVE-2026-82270?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82270 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-82270?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a server-side request forgery (SSRF) vulnerability in the /v1/proxy/* route caused by missing requestValidator middleware. An attacker can set the x-portkey-custom-host header to an internal network address (e.g., localhost, private IP ranges, or metadata services) and forward requests containing Authorization headers. The missing validation allows the gateway to relay these requests to internal services without restriction, enabling exfiltration of provider API keys and unauthorized access to internal infrastructure. The vulnerability affects Portkey AI Gateway through version 1.15.2 and requires network access to the proxy endpoint; no authentication bypass is needed if the endpoint is exposed.
Affected products
- Portkey AI Gateway through 1.15.2
Timeline
- 2026-08-28: disclosed