CVE-2026-77775

CVE-2026-77775 is a server-side request forgery (SSRF, CWE-918) in the Headroom LLM proxy, rated 7.7 (High) in CVSS 4.0: the client-controlled x-headroom-base-url request header selects the upstream base URL in both the OpenAI handler (_resolve_openai_upstream_base in headroom/proxy/handlers/openai.py) and the passthrough routes (_select_passthrough_base_url in headroom/providers/proxy_routes.py), with validation limited to the value parsing as http/https with a hostname. Because the component is a proxy, it forwards the request to whatever host the header names — including loopback, link-local (e.g., the 169.254.169.254 cloud metadata service), or RFC 1918 internal addresses, none of which are filtered — and returns the upstream response to the caller, while the client's Authorization header is also forwarded unchanged to that attacker-chosen host. An attacker who can reach the proxy's data-plane routes can therefore read responses from internal services and cloud metadata endpoints (potentially harvesting instance credentials) and can capture the proxy user's bearer/Authorization token by pointing the header at a host they control. Exposure depends on deployment: the pip console script binds to 127.0.0.1 by default (local-only), but the shipped docker-compose.yml runs with --host 0.0.0.0 and published ports without requiring a HEADROOM_PROXY_TOKEN — a configuration the server itself warns about at startup — so deployments following the shipped compose expose the affected routes to the network without authentication. There is no known exploitation in the wild, no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates about a 0.4% probability of exploitation within 30 days (30th percentile).

What to do: Upgrade to a patched Headroom release when one is published (no fixed version is specified in the available data), and in the meantime ignore, strip, or allowlist client-supplied x-headroom-base-url values, blocking loopback, link-local (169.254.0.0/16), and RFC 1918 destinations. For compose-based deployments, set a strong HEADROOM_PROXY_TOKEN, bind the service to loopback or restrict published ports with a firewall, and avoid forwarding Authorization headers to attacker-controlled upstreams. Audit exposed instances and proxy logs for requests whose x-headroom-base-url targeted the metadata service or internal addresses, and rotate any credentials that may have been relayed.