Headroom's LLM proxy lets clients specify the upstream destination via the x-headroom-base-url HTTP header. The code accepts any URL with an http or https scheme and hostname without blocking loopback, link-local, or RFC 1918 private addresses. Because the proxy returns upstream responses directly to the client and forwards the Authorization header unchanged, an attacker can access internal services and cloud metadata endpoints, potentially disclosing sensitive data. The default docker-compose deployment exposes these routes on all interfaces without requiring authentication, further increasing exposure. Versions of Headroom prior to 0.36.1 are affected.

An unauthenticated remote attacker can exploit this SSRF vulnerability to make the Headroom server send arbitrary HTTP requests to internal network resources, including cloud metadata services. This can lead to disclosure of sensitive internal information or credentials. The vulnerability does not allow integrity or availability impact but can cause significant confidentiality breaches. The default insecure deployment configuration increases the attack surface by exposing the vulnerable proxy routes without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid deploying Headroom with the default docker-compose configuration that binds to 0.0.0.0 and does not require HEADROOM_PROXY_TOKEN authentication. Restrict network access to the vulnerable proxy routes and configure authentication tokens to prevent unauthorized access. Monitor vendor advisories for official patches or updates.