CVE-2026-77776
Received Received - Intake

Memory Identity Spoofing in Headroom LLM Proxy

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: VulnCheck

Description
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name another user's identifier and read or write that user's stored LLM memory. The fix introduces a single resolve_memory_identity seam in headroom/proxy/identity.py that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, which the server itself warns about at startup, so a deployment following the shipped compose exposes the affected data-plane routes to the network without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77776
EUVD
EUVD-2026-63905

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
headroomlabs-ai headroom 0.29.0
headroomlabs-ai headroom From 0.0.0 (inc) to 0.36.1 (exc)
headroomlabs-ai headroom 0.36.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77776 is an authorization bypass vulnerability in Headroom's LLM proxy. The proxy incorrectly treats the client-supplied x-headroom-user-id header as a trusted identity without proper validation. This allows attackers to impersonate other users and access or modify their stored LLM memory. The issue occurs because the header value is not bound to the actual caller.

Detection Guidance

Check if Headroom Proxy is running with `--host 0.0.0.0` and no authentication token. Inspect network traffic for requests containing the `x-headroom-user-id` header. Use curl to test if memory partitions can be accessed by spoofing user IDs: curl -H "x-headroom-user-id: target_user" http://localhost:port/api/v1/chat

Impact Analysis

This vulnerability allows unauthorized access to other users' stored LLM memory, potentially exposing sensitive data. Attackers can read or write memory partitions by spoofing the x-headroom-user-id header. Default configurations in docker-compose.yml expose affected routes to the network without authentication, increasing risk.

Mitigation Strategies

Upgrade to Headroom Proxy v0.36.1 or later. Ensure `--host 127.0.0.1` is used instead of 0.0.0.0. Set required authentication tokens like HEADROOM_PROXY_TOKEN. Restrict the `x-headroom-user-id` header to loopback or allowlisted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart