CVE-2026-77775

Name of the Vulnerable Software and Affected Versions Headroom (affected versions not specified)

Description The LLM proxy allows clients to specify the upstream destination using the x-headroom-base-url request header. The functions resolve openai upstream base() in headroom/proxy/handlers/openai.py and select passthrough base url() in headroom/providers/proxy routes.py process this header without validating the destination. This lack of validation for loopback, link-local, or RFC 1918 addresses enables requests to reach internal services and cloud metadata addresses, disclosing their responses to the caller. Additionally, the Authorization header is forwarded unchanged to the client-specified host. When deployed using the reference docker-compose.yml with --host 0.0.0.0 and without a HEADROOM PROXY TOKEN, these data-plane routes are exposed to the network without authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.