WebSocket Server Vulnerability in Headroom Application
CVE-2026-71416

8.8HIGH

Key Information:

Vendor

Headroomlabs-ai

Status
Headroom
Vendor
CVE Published:
11 September 2026

What is CVE-2026-71416?

The Headroom WebSocket server prior to version 0.35.0 lacks validation of the Origin header in incoming client WebSocket requests. This oversight allows unauthorized clients to send arbitrary requests to large language model services without proper authentication. If exploited, this vulnerability can potentially expose sensitive API keys stored in environment variables, thus risking the integrity and security of data processed by the OpenAI API. Users are advised to upgrade to version 0.35.0 or later to mitigate this risk.

Affected Version(s)

headroom < 0.35.0

References

https://github.com/headroomlabs-ai/headroom/security/advi...
x_refsource_CONFIRM
https://github.com/headroomlabs-ai/headroom/releases/tag/...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.