[new-cve] CVE-2026-71416 — Headroom compresses data before the data reaches a large language model. Prior t

[github-actions]

New CVE — AI/LLM Related

CVE ID: CVE-2026-71416
Published: 2026-09-11T14:17:32.390
CVSS Score: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Description

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the OPENAI_API_KEY environment variable. Version 0.35.0 fixes the issue.

Suggested OWASP Mapping

Manual mapping required

Suggested Action

Review this CVE against the OWASP GenAI Crosswalk entries. Update data/incidents.json or relevant mapping files if this CVE represents a real-world exploitation of a mapped threat.

[emmanuelgjr]

Triage: relevant, candidate incident. Headroom: the WebSocket proxy in front of an LLM does not validate Origin, so a browser client can make authenticated LLM requests with the operator's API key. Candidate incident record.

Not added to data/incidents.json yet: that file is being changed by open PRs #87 and #89, and incident records are added one at a time behind them. Any control_failures for it would need a quotable basis from the advisory, per docs/EVIDENCE_METHODOLOGY.md (in #87).

Triage of the weekly watcher backlog, 2026-09-14. A label and a reason only: no mapping or incident was changed. Reopen or relabel if this reading is wrong.

[emmanuelgjr]

Recorded as INC-134 — Headroom < 0.35.0, CVE-2026-71416 / GHSA-h46j-26q3-rggf — in PR #117, merged as ea971a0. Fields transcribed from NVD and, where one exists, the vendor's own GitHub advisory; severity is the published CVSS base severity, and the control failure quotes its source with confirmed_by empty (drafted, not confirmed).