01 Record

CVE-2026-77775

Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation

HighPUBLISHEDCNA: VulnCheck

Base score7.7 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

02 Description

Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation

Published

2026-08-21 11:22Z14 HR AGO

Last updated

2026-08-21 11:44Z13 HR AGO

Reserved

2026-08-21

Assigning CNA

VulnCheck

Record state

PUBLISHED

Severity

High (CVSS 7.7)

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Weaknesses

SSVC decision

ExploitationnoneAutomatableyesTechnical Impactpartial

Data version

5.2

Document digest

ee58fd9fb8f1f0d10baebb9c006343bbb19ca26ed10da2aeef8e0318da603dfe

VendorProductVersionsPlatforms

Headroom LabsHeadroom0 to < 0.36.1—

github.comPull Request #2207 addressing the assessment findingshttps://github.com/headroomlabs-ai/headroom/pull/2207issue-tracking
github.comHeader handling in the OpenAI proxy handler at v0.29.0https://github.com/headroomlabs-ai/headroom/blob/v0.29.0/headroom/proxy/handlers/openai.pytechnical-description
github.comis_safe_upstream_url guard introduced by the fixhttps://github.com/headroomlabs-ai/headroom/blob/v0.36.1/headroom/proxy/upstream_guard.pytechnical-description
github.comhttps://github.com/headroomlabs-ai/headroomproduct
www.vulncheck.comVulnCheck Advisory: Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validationhttps://www.vulncheck.com/advisories/headroom-proxy-sends-upstream-requests-to-a-client-supplied-base-url-without-address-validationthird-party-advisory