{"id":"EUVD-2025-200120","enisaUuid":"068c8311-c42a-3d09-940d-bdfac4c3eb41","description":"Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF attacks. This vulnerability is fixed in 1.14.0.","datePublished":"Dec 1, 2025, 10:25:36 PM","dateUpdated":"Dec 2, 2025, 2:11:29 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/Portkey-AI/gateway/security/advisories/GHSA-hhh5-2cvx-vmfp\nhttps://github.com/Portkey-AI/gateway/pull/1372\nhttps://github.com/Portkey-AI/gateway/commit/b5a7825ba5f4e6918deb32d9969899ce2229a885\n","aliases":"CVE-2025-66405\nGHSA-hhh5-2cvx-vmfp\n","assigner":"GitHub_M","epss":0.37,"enisaIdProduct":[{"id":"f69bb9dd-34c3-3c4d-b8cc-f3b54ec6c926","product":{"name":"Gateway","vendor":{"name":"NetScaler"}},"product_version":"\u003c 1.14.0"}],"enisaIdVendor":[{"id":"02f270e6-8096-3ffe-aaf9-7732ecc0650c","vendor":{"name":"Portkey-AI"}}],"enisaIdVulnerability":[{"id":"109e0069-43dd-38ee-9f1f-8975ffc6bbdc","vulnerability":{"id":"GHSA-hhh5-2cvx-vmfp","description":"Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host","datePublished":"Dec 2, 2025, 1:08:37 AM","dateUpdated":"Dec 2, 2025, 1:08:38 AM","baseScore":0.0,"references":"https://github.com/Portkey-AI/gateway/security/advisories/GHSA-hhh5-2cvx-vmfp\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-66405\nhttps://github.com/Portkey-AI/gateway/pull/1372\nhttps://github.com/Portkey-AI/gateway/commit/b5a7825ba5f4e6918deb32d9969899ce2229a885\nhttps://github.com/Portkey-AI/gateway\n","enisa_id":"EUVD-2025-200120\n","aliases":"GHSA-hhh5-2cvx-vmfp\nCVE-2025-66405\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"79ce9ea7-bf9f-3004-a0f3-c9402e01a8f4","vulnerability":{"id":"CVE-2025-66405","description":"Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF attacks. This vulnerability is fixed in 1.14.0.","datePublished":"Dec 1, 2025, 10:25:36 PM","dateUpdated":"Dec 2, 2025, 2:11:29 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/Portkey-AI/gateway/security/advisories/GHSA-hhh5-2cvx-vmfp\nhttps://github.com/Portkey-AI/gateway/pull/1372\nhttps://github.com/Portkey-AI/gateway/commit/b5a7825ba5f4e6918deb32d9969899ce2229a885\n","enisa_id":"EUVD-2025-200120\n","assigner":"GitHub_M","epss":0.37,"dataProcessed":"Oct 27, 2026, 7:20:58 AM","vulnerabilityProduct":[{"id":"efb6ac4b-ed2d-3747-923d-fd90c4947c52","product":{"name":"Gateway","vendor":{"name":"NetScaler"}},"product_version":"\u003c 1.14.0"}],"vulnerabilityVendor":[{"id":"53e07ee0-f2bd-3922-b943-bed7fbb90715","vendor":{"name":"Portkey-AI"}}]}}],"enisaIdAdvisory":[]}