Is CVE-2026-82270 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82270?

CVE-2026-82270 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-82270

Description

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal services and exfiltrate provider API keys.