CVE-2026-71416: Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)
Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the OPENAIAPIKEY environment variable. Version 0.35.0 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Headroomto a version that resolves this vulnerability.Fixed in 0.35.0
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Deployments running a Headroom version before 0.35.0 are exposed when the WebSocket server is reachable by a browser and an OpenAI API key is present in the OPENAI_API_KEY environment variable.
What does an attacker need to exploit this issue?
An attacker needs to cause a malicious WebSocket client to run in a traditional or headless browser that has network access to the Headroom proxy. No authentication is required for the resulting arbitrary LLM requests.
Is there a fixed version?
Yes. Version 0.35.0 fixes the missing Origin-header validation.