Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77776— Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity

Quick assessment

Affected
Headroom Labs Headroom
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Headroom 的 LLM 代理从 请求头中推导内存（memory）的所有者。该请求头在 中的多个位置被直接读取，包括聊天完成（chat completion）和 WebSocket 路径。然而，没有任何机制将该值绑定到实际调用者。因此，客户端可以伪装成其他用户的标识符，进而读取或写入该用户的存储 LLM 记忆数据。 修复方案在 中引入了一个统一的“解析内存身份”（resolve_memory_identity）接口：仅在请求来自本地回环（loopback）或白名单调用者时才尊重该请求头；否则，将身份绑定到代理令

CVSS 9.1 · Critical EPSS 0.34% · P28

Affected Version Matrix 2

VendorProduct Version RangeStatus
Headroom Labs Headroom < 0.36.1 affected
0.36.1 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77776

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity
Source: CVE Program / CVE List V5
Vulnerability Description
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name another user's identifier and read or write that user's stored LLM memory. The fix introduces a single resolve_memory_identity seam in headroom/proxy/identity.py that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, which the server itself warns about at startup, so a deployment following the shipped compose exposes the affected data-plane routes to the network without authentication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Headroom Labs Headroom 0 ~ 0.36.1 -

II. Public POCs for CVE-2026-77776

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 6809 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-77776

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77776 (2)

Vendor Advisories for CVE-2026-77776 (1)

IV. Related Vulnerabilities

Same product: Headroom
Same vendor: Headroom Labs
Same weakness: CWE-639

V. Comments for CVE-2026-77776

No comments yet

Leave a comment