Headroom Labs vulnerabilities and threats

Headroom Labs Headroom prior to version 0.36.1 contains an authorization bypass vulnerability where the memory owner is derived directly from a user-controlled HTTP header (x-headroom-user-id) without proper binding to the caller's identity. This allows an attacker to impersonate other users and access or modify their stored LLM memory. The default deployment configuration exposes affected routes without authentication, increasing risk. A fix is available that restricts header usage to loopback or allowlisted callers and binds identity to proxy-token fingerprints or OS users.

CVE-2026-77775 is a Server-Side Request Forgery (SSRF) vulnerability in Headroom Labs' Headroom product. The vulnerability arises because the LLM proxy accepts a client-supplied x-headroom-base-url header without properly restricting the destination URL. This allows attackers to make requests to internal services, including cloud metadata endpoints, and receive their responses. The default deployment configuration exposes these routes without authentication, increasing the risk of exploitation. The vulnerability affects versions prior to 0.36.1 and has a high severity score of 8.6.