headroomlabs-ai CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH headroomlabs-ai CVE published 2026-10-02

CVE-2026-71416

CVE-2026-71416 is a high-severity vulnerability in the Headroom WebSocket server, which allows malicious clients to perform arbitrary LLM requests without authentication. This issue was fixed in version 0.35.0. The vulnerability affects Headroom deployments, especially those using the OpenAI API, and defenders should assess exposure and prioritize upgrading to version 0.35.0 or later. Evidence is limited [truncated]