Headroom’s proxy trusts the x-headroom-user-id request header without validating the caller, allowing an attacker to impersonate any user. By setting this header to another user’s identifier, a malicious client can read or overwrite that user’s stored LLM memory, resulting in confidentiality and integrity loss of private data.

The vulnerability affects Headroom Labs’ Headroom proxy prior to the fix introduced in v0.36.1. Deployments that use the default docker‑compose configuration with the server listening on 0.0.0.0 and no HEADROOM_PROXY_TOKEN, or any instance that accepts the header from untrusted external clients, are impacted.

With a CVSS score of 9.3, the flaw is considered critical. The EPSS score is not available, and the vulnerability is not listed in the KEV catalog. An attacker can exploit it remotely by sending HTTP requests over the network to any exposed data‑plane route, because the service accepts the header unconditionally and no authentication is required for the affected paths.