CVE-2026-71416

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71416
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71416.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71416
Aliases
  • GHSA-h46j-26q3-rggf
Published
2026-09-11T13:34:38Z
Modified
2026-09-12T03:46:28Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)
Details

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the OPENAI_API_KEY environment variable. Version 0.35.0 fixes the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1385",
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71416.json"
}
References

Affected packages

Git / github.com/headroomlabs-ai/headroom

Affected ranges

Type
GIT
Repo
https://github.com/headroomlabs-ai/headroom
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
93f2d7a2da4d3b6c88f31bad164ae299cf042104
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.35.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.10.10
v0.10.11
v0.10.12
v0.10.13
v0.10.14
v0.10.15
v0.10.16
v0.10.17
v0.10.18
v0.10.19
v0.10.2
v0.10.3
v0.10.4
v0.10.5
v0.10.6
v0.10.7
v0.10.8
v0.10.9
v0.11.0
v0.12.0
v0.13.0
v0.13.1
v0.13.2
v0.13.3
v0.13.4
v0.13.5
v0.13.6
v0.13.7
v0.13.8
v0.14.0
v0.14.1
v0.14.2
v0.14.3
v0.14.4
v0.14.5
v0.15.0
v0.15.1
v0.16.0
v0.17.0
v0.18.0
v0.18.1
v0.18.2
v0.19.0
v0.2.15
v0.20.0
v0.20.1
v0.20.10
v0.20.11
v0.20.12
v0.20.13
v0.20.14
v0.20.15
v0.20.16
v0.20.17
v0.20.18
v0.20.19
v0.20.2
v0.20.20
v0.20.21
v0.20.22
v0.20.23
v0.20.24
v0.20.25
v0.20.26
v0.20.27
v0.20.3
v0.20.4
v0.20.5
v0.20.6
v0.20.7
v0.20.8
v0.20.9
v0.21.0
v0.21.1
v0.21.10
v0.21.11
v0.21.12
v0.21.13
v0.21.14
v0.21.15
v0.21.16
v0.21.17
v0.21.18
v0.21.19
v0.21.2
v0.21.20
v0.21.21
v0.21.22
v0.21.23
v0.21.24
v0.21.25
v0.21.26
v0.21.27
v0.21.28
v0.21.29
v0.21.3
v0.21.30
v0.21.31
v0.21.32
v0.21.33
v0.21.34
v0.21.35
v0.21.36
v0.21.37
v0.21.38
v0.21.4
v0.21.5
v0.21.6
v0.21.7
v0.21.8
v0.21.9
v0.22.0
v0.22.1
v0.22.2
v0.22.3
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.3.0
v0.3.7
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.5.2
v0.5.20
v0.5.26
v0.5.27
v0.5.28
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.6.7
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71416.json"