LLM Proxy Header Injection Enables Server-Side Request Forgery

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. _resolve_openai_upstream_base in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use as the upstream base; _select_passthrough_base_url in headroom/providers/proxy_routes.py reads the same header for the passthrough routes. No check rejects loopback, link-local, or RFC 1918 destinations, and because the component is a proxy the upstream response is returned to the caller, so the request reaches internal services and cloud metadata addresses and their responses are disclosed. The Authorization header accompanying the request is forwarded unchanged to the caller-designated host. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, which the server itself warns ab

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Headroom's LLM proxy vulnerability allows attackers to manipulate the x-headroom-base-url request header to redirect upstream requests to arbitrary destinations, including internal networks and loopback addresses. The vulnerability exists because the proxy validates only that the header contains a parseable HTTP/HTTPS scheme and hostname, but fails to reject requests targeting loopback (127.0.0.1), link-local (169.254.x.x), or RFC 1918 private IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x). This Server-Side Request Forgery (SSRF) vulnerability affects any organization running Headroom as an LLM proxy service, potentially exposing internal services, metadata endpoints, and backend systems that should never be directly accessible from untrusted clients.

Casky's 331 mapped security skills detect this attack pattern through Claude's extended reasoning applied to MITRE ATT&CK techniques TA0001 (Initial Access) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious findings when the system detects: (1) repeated x-headroom-base-url header manipulation attempts with internal IP addresses or loopback targets, (2) traffic redirection to non-whitelisted upstream destinations deviating from expected cloud endpoints, and (3) reconnaissance-style requests probing for internal service exposure. The skills correlate these header injection patterns with SSRF indicators, revealing adversaries attempting to bypass network segmentation to access internal APIs, configuration endpoints, or credential stores that trusted external services should never reach.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-77775.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-77775

Casky has 331 skills that investigate the attack patterns behind CVE-2026-77775. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn