{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/headroom/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-77776"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LLM proxy"],"_cs_severities":["critical"],"_cs_tags":["identity-spoofing","cve","web-application-vulnerability","web-application","ssrf","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Headroom"],"content_html":"\u003cp\u003eCVE-2026-77776 is an authentication and authorization vulnerability in the Headroom LLM proxy. The application derives memory ownership directly from the 'x-headroom-user-id' HTTP header in 'headroom/proxy/handlers/openai.py' without verifying the caller's identity. This allows an attacker to manipulate the header to impersonate any user, resulting in unauthorized access to sensitive stored LLM memory.\u003c/p\u003e\n\u003cp\u003eThe risk is significantly amplified by the provided 'docker-compose.yml' file, which defaults to binding the service to '0.0.0.0' and fails to enforce the 'HEADROOM_PROXY_TOKEN' environment variable. When deployed using this configuration, the service exposes its data-plane endpoints to the network, enabling unauthenticated attackers to perform identity spoofing remotely. Defenders must ensure that the proxy is bound to local interfaces only or that the 'HEADROOM_PROXY_TOKEN' is strictly enforced for all inbound requests.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read or write the LLM memory of any user registered within the Headroom instance. This could lead to the exposure of proprietary data, sensitive user conversations, or the injection of malicious context into future LLM interactions, compromising the integrity of all stored assistant memory.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the 'docker-compose.yml' configuration to bind the proxy to '127.0.0.1' and verify that 'HEADROOM_PROXY_TOKEN' is enabled and non-default.\u003c/li\u003e\n\u003cli\u003eImplement network-level access controls to restrict access to the LLM proxy port to authorized internal IP addresses only.\u003c/li\u003e\n\u003cli\u003ePatch the Headroom LLM proxy to the version where the 'resolve_memory_identity' seam is introduced in 'headroom/proxy/identity.py'.\u003c/li\u003e\n\u003cli\u003eAudit logs for suspicious 'x-headroom-user-id' header patterns that deviate from expected user identification formats.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-21T13:24:29Z","date_published":"2026-08-21T13:24:19Z","id":"https://feed.craftedsignal.io/briefs/2026-08-headroom-identity-spoofing/","summary":"The Headroom LLM proxy improperly derives memory ownership from the unauthenticated 'x-headroom-user-id' request header, allowing attackers to perform unauthorized read and write operations on arbitrary user LLM memory.","title":"Authentication Bypass in Headroom LLM Proxy via Header Spoofing","url":"https://feed.craftedsignal.io/briefs/2026-08-headroom-identity-spoofing/"}],"language":"en","title":"CraftedSignal Threat Feed - Headroom","version":"https://jsonfeed.org/version/1.1"}