Headroom WebSocket proxy can spend OpenAI keys for reachable browsers
Direct answer
Headroom WebSocket proxy can spend OpenAI keys for reachable browsers, also tracked as CVE-2026-71416 is a high-severity threat campaign HOL Guard tracked from Sep 11, 2026 to Sep 21, 2026, verified against 3 primary sources and last reviewed Sep 22, 2026. Active tracking has ended and the record remains published as a permanent historical research record.
Headroom before 0.35.0 is vulnerable to cross-site WebSocket hijacking because the proxy does not validate Origin. A malicious browser client that can reach the proxy can make arbitrary LLM requests using the configured OpenAI key. Upgrade to 0.35.0 or later and rotate exposed keys if applicable.
Also tracked as CVE-2026-71416
- First observed
- Sep 11, 2026
- Last observed
- Sep 21, 2026
- Last reviewed
- Sep 22, 2026
- Tracking ended
- Sep 21, 2026
Record exports
Uncertainty and limitations
Read the evidence limits before acting on this record.
Affected and fixed versions follow the current GitHub CNA record. Exposure depends on a browser being able to reach the Headroom proxy and the OpenAI key being available to that service.
- Campaign tracks CVE-2026-71416 only.
- A malicious traditional or headless browser must be able to reach the Headroom proxy for the described CSWSH path.
- The current CNA assessment is CVSS 3.1 8.8 High.
- HOL blog is operator guidance.
Guard coverage and policy
What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.
No Guard coverage mapping or campaign-specific policy guidance is published for this record.
Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
Timeline
Reviewed events, oldest first, each tied to a verified source.
- Disclosure
CVE-2026-71416 Headroom WebSocket OpenAI key exposure path disclosed.
- Correction
HOL reconciled the current 0.35.0 fixed version and CVSS 8.8 High CNA assessment.
Sources:CVE Record CVE-2026-71416·HOL Guard operator write-up
Publication clock: 265.0 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; historical backfill outside target.
Sources
Every claim on this record is traceable to the sources below.
Campaign questions, answered
Headroom before 0 is vulnerable to cross-site WebSocket hijacking because the proxy does not validate Origin. HOL Guard tracked the campaign from Sep 11, 2026 to Sep 21, 2026.
No. Active tracking ended Sep 21, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.
The record cites 3 primary sources, names 0 reviewed artifacts, and was last fully reviewed Sep 22, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.
Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Affected and fixed versions follow the current GitHub CNA record. Exposure depends on a browser being able to reach the Headroom proxy and the OpenAI key being available to that service.
Reviewed in full by HOL Guard Security Publishing.
- Published
- Last full review
- Last modified
Record HGTC-2026-BF20F0E4