CVE-2026-77776: Authorization Bypass Through User-Controlled Key in Headroom Labs Headroom

The vulnerability in Headroom Labs Headroom involves the LLM proxy deriving the memory owner from the x-headroom-user-id HTTP request header, which is user-controlled and unchecked. This header is used in multiple request handling points, including chat completion and websocket paths, allowing an attacker to specify another user's identifier and read or write that user's stored LLM memory. The default docker-compose deployment exposes these routes publicly without requiring authentication, exacerbating the risk. The fix introduces a resolve_memory_identity function that restricts the header's use to loopback or allowlisted callers and otherwise binds identity to the proxy-token fingerprint or OS user. The vulnerability affects versions prior to 0.36.1.

An unauthenticated remote attacker can bypass authorization controls by specifying arbitrary user identifiers in the x-headroom-user-id header, enabling unauthorized reading and writing of other users' stored LLM memory. This leads to a complete confidentiality and integrity compromise of user data stored in the LLM memory. The vulnerability does not affect availability. The CVSS score is 9.1 (critical), reflecting network attack vector, no privileges required, no user interaction, and high confidentiality and integrity impact.

A fix is available in Headroom version 0.36.1 that properly restricts the use of the x-headroom-user-id header to loopback or allowlisted callers and binds user identity to proxy-token fingerprints or operating system users. Users should upgrade to version 0.36.1 or later. Additionally, deployments should avoid exposing the server on 0.0.0.0 without authentication tokens (HEADROOM_PROXY_TOKEN). The default pip console script binds to 127.0.0.1, which is safer. Until patched, restrict network exposure of the affected routes and require authentication tokens.