Headroom Labs

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Headroom Labs records in CISA KEV

No Headroom Labs vulnerabilities are listed in CISA KEV.

2 records

TI-2026-54168 CVE-2026-77776 · GHSA-5vg3-c628-vf56

MEDIUM 49

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00613 Published 2026-08-21 Fixed in 0.36.1 CWE-639

TI-2026-54167 CVE-2026-77775 · GHSA-4j5r-9p93-j2px

MEDIUM 40

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00593 Published 2026-08-21 Fixed in 0.36.1 CWE-918