CVE-2026-77776
CriticalCVSS 9.1Summary
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points, and nothing binds the value to the caller. A client can name another user's identifier and read or write that user's stored LLM memory. The fix introduces a single resolve_memory_identity seam that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, exposing the affected data-plane routes to the network without authentication.
Risk Assessment
An attacker can access other users' LLM memory, potentially leading to data confidentiality breach or manipulation.
Recommendation
Configure a required HEADROOM_PROXY_TOKEN and restrict access to the proxy, and upgrade to a patched version.
Original NVD description (English source)
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name another user's identifier and read or write that user's stored LLM memory. The fix introduces a single resolve_memory_identity seam in headroom/proxy/identity.py that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, which the server itself warns about at startup, so a deployment following the shipped compose exposes the affected data-plane routes to the network without authentication.