{"apiVersion":"1.0","identifier":"CVE-2026-77776","description":"Headroom-s LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name another user-s identifier and read or write that user-s stored LLM memory. The fix introduces a single resolve_memory_identity seam in headroom/proxy/identity.py that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, which the server itself warns about at startup, so a deployment following the shipped compose exposes the affected data-plane routes to the network without authentication.","publishedAt":"2026-08-21T12:16:36","lastModifiedAt":"2026-08-21T22:16:46","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77776","cvssScore":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","epssProbability":0.00345,"riskScore":0.94,"affectedProduct":"headroom","affectedVersions":"unknown","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-77776","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-77776","en":"https://www.redsauce.net/en/cves/CVE-2026-77776","fr":"https://www.redsauce.net/fr/cves/CVE-2026-77776","pt":"https://www.redsauce.net/pt/cves/CVE-2026-77776","de":"https://www.redsauce.net/de/cves/CVE-2026-77776","sk":"https://www.redsauce.net/sk/cves/CVE-2026-77776","el":"https://www.redsauce.net/el/cves/CVE-2026-77776"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-77776"}}