CVE-2025-66405: Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host

December 2, 2025

The gateway determines the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF (CWE-918) attack

References

github.com/Portkey-AI/gateway
github.com/Portkey-AI/gateway/commit/b5a7825ba5f4e6918deb32d9969899ce2229a885
github.com/Portkey-AI/gateway/pull/1372
github.com/Portkey-AI/gateway/security/advisories/GHSA-hhh5-2cvx-vmfp
github.com/advisories/GHSA-hhh5-2cvx-vmfp
nvd.nist.gov/vuln/detail/CVE-2025-66405

Code Behaviors & Features

Detect and mitigate CVE-2025-66405 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →