Headroom's LLM proxy allows a client to specify an arbitrary upstream destination through the x-headroom-base-url request header. The implementation accepts any URL that parses as a valid http or https scheme and a hostname, without rejecting loopback, link‑local, or RFC 1918 addresses. This is a CWE‑918 vulnerability. The forwarded Authorization header and the unfiltered proxy response mean that requests can reach internal services, cloud metadata endpoints, and other sensitive systems, exposing their responses and potentially enabling an attacker to interact with or exploit those services.

Headroom Labs' Headroom LLM proxy is affected. No version‑specific information is provided in the advisory, so all current releases prior to a fix are potentially vulnerable.

The CVSS base score of 7.7 indicates a high‑severity flaw. EPSS is not available, and the vulnerability is not listed in CISA KEV, but the lack of address validation and the default exposure of network ports mean that an attacker could exploit the proxy from any network location that reaches the service. The attack requires sending a crafted HTTP request containing the x-headroom-base-url header; no authentication is required when using the default docker‑compose configuration, so the risk to networks that inadvertently expose the proxy is significant.