CVE-2026-77776 Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity
Attackers can impersonate other users by spoofing the x-headroom-user-id header to read or modify their LLM memory, particularly in exposed Docker deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77776?
CVE-2026-77776 is a critical authentication bypass vulnerability in Headroom, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name another user's identifier and read or write that user's stored LLM memory. The fix introduces a single resolve_memory_identity seam in headroom/proxy/identity.py that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, which the server itself warns about at startup, so a deployment following the shipped compose exposes the affected data-plane routes to the network without authentication.
Weakness: CWE-639
Which versions are affected by CVE-2026-77776?
How do I fix CVE-2026-77776?
No fix has been published for CVE-2026-77776 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-77776 being exploited?
There is no known exploitation of CVE-2026-77776 in the wild and no public exploit code.
Sources
Also known as GHSA-5vg3-c628-vf56.