CVE-2026-77775: Server-Side Request Forgery (SSRF) in Headroom Labs Headroom

Headroom's LLM proxy component accepts the x-headroom-base-url HTTP header from clients to determine the upstream destination URL. The code only validates that the URL uses http or https and has a hostname but does not block requests to loopback, link-local, or RFC 1918 private IP addresses. Because the proxy forwards the Authorization header unchanged and returns upstream responses to the client, an attacker can use this to access internal services and cloud metadata endpoints, potentially disclosing sensitive information. The default docker-compose deployment exposes the proxy on all network interfaces without requiring authentication, further increasing exposure. This SSRF vulnerability affects Headroom versions before 0.36.1.

An unauthenticated attacker can exploit this SSRF vulnerability to make arbitrary HTTP requests from the Headroom server to internal network services, including cloud metadata endpoints. This can lead to disclosure of sensitive internal information such as credentials or configuration data. The vulnerability does not allow integrity or availability impact but has a high confidentiality impact. The default insecure deployment configuration increases the risk of exploitation by exposing the vulnerable proxy endpoints without authentication.

A fix is available in Headroom version 0.36.1 and later. Users should upgrade to version 0.36.1 or newer to remediate this vulnerability. Until patched, deployments should ensure that the proxy is not exposed to untrusted networks and that authentication (e.g., HEADROOM_PROXY_TOKEN) is enforced on data-plane routes. Avoid using the default docker-compose configuration that binds to 0.0.0.0 without authentication. Restrict access to the proxy and validate or sanitize the x-headroom-base-url header to prevent SSRF.