CVE-2026-77776

Name of the Vulnerable Software and Affected Versions Headroom (affected versions not specified)

Description The LLM proxy derives the memory owner from the x-headroom-user-id request header. This header is read directly within headroom/proxy/handlers/openai.py, specifically in the chat completion and websocket paths, without verifying the value against the actual caller. Consequently, a client can impersonate another user by providing their identifier to read or write that user's stored LLM memory. Deployments using the reference docker-compose.yml are particularly exposed as they may ship with --host 0.0.0.0 and no required HEADROOM PROXY TOKEN, leaving data-plane routes accessible to the network without authentication.

Recommendations Update the software to the version that implements the resolve memory identity function in headroom/proxy/identity.py to ensure the x-headroom-user-id header is only honored for loopback or allowlisted callers. Avoid deploying the proxy with --host 0.0.0.0 without a configured HEADROOM PROXY TOKEN to prevent unauthorized network access.