# CVE-2026-77775: Headroom LLM proxy SSRF via x-headroom-base-url header

Source: https://junglewise.ai/threats/cve-2026-77775-headroom-llm-proxy-ssrf-via-x-headroom-base-url-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77775 · Severity: high · CVSS 8.6 · Published 2026-08-21

Headroom is an LLM proxy server that compresses tool outputs and logs before sending them to language models. A critical security flaw allows unauthenticated clients to redirect traffic to arbitrary internal network addresses and cloud metadata services by manipulating the x-headroom-base-url request header, exposing sensitive internal data and authentication credentials. The default Docker deployment is particularly vulnerable, binding to all network interfaces without authentication protection.

Technologies: [Headroom Labs Headroom](https://junglewise.ai/threats/technologies/headroom). Vendors: [Headroom Labs](https://junglewise.ai/threats/vendors/headroom-labs).

## Quick answers

**Is CVE-2026-77775 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77775 being exploited in the wild.

**How severe is CVE-2026-77775?** High severity, with a CVSS score of 8.6, published 21 August 2026.

**Which products and versions are affected?** Headroom Labs Headroom <UNKNOWN>.

**Is there a fix for CVE-2026-77775?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77775 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-77775?** Check whether you run Headroom Labs Headroom at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a Server-Side Request Forgery (SSRF) vulnerability in the request header validation logic. The _resolve_openai_upstream_base function in headroom/proxy/handlers/openai.py and _select_passthrough_base_url in headroom/providers/proxy_routes.py accept the x-headroom-base-url header value and validate only that it contains a valid HTTP/HTTPS URL with a hostname, without rejecting loopback (127.0.0.1), link-local, or RFC 1918 private address ranges. Because the proxy returns the upstream response to the caller, an attacker can access internal services and cloud metadata endpoints (e.g., AWS IMDSv2). Additionally, the Authorization header is forwarded unchanged to the attacker-controlled destination, disclosing authentication credentials. The vulnerability is network-reachable in default Docker deployments (which bind 0.0.0.0 with no HEADROOM_PROXY_TOKEN requirement) but mitigated in pip console script deployments that bind only 127.0.0.1 by default.

## Affected products

- Headroom Labs Headroom <UNKNOWN>

## Timeline

- 2026-08-21: disclosed
- 2026-08-21: advisory: CVE-2026-77775

## References

- [https://pypi.org/](https://pypi.org/)
- [https://github.com/headroomlabs-ai/headroom](https://github.com/headroomlabs-ai/headroom)

## Related threats

- [Headroom Cross-Site WebSocket Hijacking in proxy server](https://junglewise.ai/threats/cve-2026-71416-headroom-cross-site-websocket-hijacking-in-proxy-server)
- [Headroom LLM proxy authentication bypass via x-headroom-user-id header](https://junglewise.ai/threats/cve-2026-77776-headroom-llm-proxy-authentication-bypass-via-x-headroom-user-id)