SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-77776 2026-08-21

CVE-2026-77776: Headroom LLM Proxy Trusts a Client-Supplied User ID Header

"A critical (CVSS 9.1) authorization flaw in Headroom's LLM proxy lets any client read or write another user's stored LLM memory simply by naming their identifier in a request header."

A critical (CVSS 9.1) authorization flaw in Headroom's LLM proxy lets any client read or write another user's stored LLM memory simply by naming their identifier in a request header.

What Is It

Headroom's LLM proxy derives the memory owner directly from the x-headroom-user-id request header. The header is read at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the supplied value to the actual caller. A client can therefore claim another user's identifier and read or write that user's stored LLM memory; a textbook CWE-639 (Authorization Bypass Through User-Controlled Key).

Why It Matters

VulnCheck rates this CVSS 3.1 9.1 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), with a CVSS 4.0 score of 9.3. The attack is remote, low-complexity, and requires no privileges and no user interaction. Impact is high to both confidentiality and integrity: an attacker can exfiltrate another user's persisted LLM memory and also poison it with attacker-chosen content.

Exposure depends on deployment. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, a condition the server itself warns about at startup. A deployment following the shipped compose file exposes the affected data-plane routes to the network with no authentication at all.

What's Vulnerable

Patch Status

Upgrade headroom-ai to 0.36.1 or later. The fix introduces a single resolve_memory_identity seam in headroom/proxy/identity.py that honors the header only for loopback or allowlisted callers, and otherwise binds identity to the proxy-token fingerprint or the operating system user. Operators using the reference docker-compose.yml should also avoid binding 0.0.0.0 with published ports and should set HEADROOM_PROXY_TOKEN.

This CVE is not listed in the CISA KEV catalog, and no active exploitation has been confirmed in the supplied data. CVSS 4.0 exploit maturity is Not Defined. NVD status is "Received" as of publication on 2026-08-21.

Sources