Skip to content
OpenAdvisories

Vendor

Headroom Labs

2 known vulnerabilities.

Products

Headroom 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.6
    CVE-2026-77775

    Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation

    Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. _resolve_openai_upstream_base in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https sche…

    Headroom Labs Headroom