CVE-2026-77775: Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation
Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. resolveopenaiupstreambase in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use as the upstream base; selectpassthroughbaseurl in headroom/providers/proxyroutes.py reads the same header for the passthrough routes. No check rejects loopback, link-local, or RFC 1918 destinations, and because the component is a proxy the upstream response is returned to the caller, so the request reaches internal services and cloud metadata addresses and their responses are disclosed. The Authorization header accompanying the request is forwarded unchanged to the caller-designated host. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOMPROXYTOKEN, which the server itself warns about at startup, so a deployment following the shipped compose exposes the affected data-plane routes to the network without authentication.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed?
Deployments following the reference docker-compose.yml are exposed to the network because it binds the proxy to 0.0.0.0, publishes ports, and does not require HEADROOM_PROXY_TOKEN. The pip console script instead binds to 127.0.0.1 by default.
What does an attacker need to exploit this?
An attacker needs network access to an affected proxy route and must be able to supply the x-headroom-base-url header. No authentication or user interaction is required in the described compose deployment.
What can an attacker reach and disclose?
The attacker can direct upstream requests to HTTP or HTTPS hosts with a hostname, including loopback, link-local, RFC 1918, and cloud metadata addresses. The upstream response is returned to the caller, and the request Authorization header is forwarded unchanged to the attacker-selected host.
What can be done if patching is not immediately possible?
Do not expose the proxy data-plane routes to untrusted networks. Bind the service to localhost where possible, require HEADROOM_PROXY_TOKEN, and restrict network access so untrusted clients cannot send x-headroom-base-url.