{"metadata": {"vulnerability": "CVE-2026-77776", "count": 22, "kinds": {"milestone": 4, "sighting": 9, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-08-20T00:00:00Z", "date_only": false, "value": "2026-08-20T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-77776", "field": "containers.cna.datePublic"}, {"timestamp": "2026-08-21T11:09:25.553Z", "date_only": false, "value": "2026-08-21T11:09:25.553Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-77776", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-21T11:22:51.779Z", "date_only": false, "value": "2026-08-21T11:22:51.779Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-77776", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-21T11:22:51.779Z", "date_only": false, "value": "2026-08-21T11:22:51.779Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-77776", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-21T12:00:33.474Z", "date_only": false, "value": "2026-08-21T12:00:33.474614Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117133386151660614", "record": "cve-2026-77776", "field": "creation_timestamp", "uuid": "62c3d447-9bb8-4742-b795-027221acf78a", "content": "CRITICAL: CVE-2026-77776 in Headroom Labs Headroom (<0.36.1) allows unauth'd attackers to spoof x-headroom-user-id and access/modify any user's LLM memory. Default configs expose this via 0.0.0.0 binding. Restrict access & use auth tokens. https://radar.offseq.com/threat/cve-2026-77776-authorization-bypass-through-user-controlled-key-in-headroom-labs-headroom-0c2eff15c1a3dc1f #OffSeq #CVE #infosec #LLM", "url": "https://infosec.exchange/users/offseq/statuses/117133386151660614"}, {"timestamp": "2026-08-21T12:00:34.435Z", "date_only": false, "value": "2026-08-21T12:00:34.435943Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtlpl4zilt2n", "record": "cve-2026-77776", "field": "creation_timestamp", "uuid": "76c223bf-07f2-4f6b-9f33-c6a33b08a7bb", "content": "CVE-2026-77776: Headroom Labs Headroom (CRITICAL) lets remote attackers bypass auth using x-headroom-user-id, fully compromising user LLM memory. Deploy with strict access controls & enable authentication. https://radar.offseq.com/threat/cve-2026-77776-authorization-bypass-through-user-controlled...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mtlpl4zilt2n"}, {"timestamp": "2026-08-21T12:13:30.073Z", "date_only": false, "value": "2026-08-21T12:13:30.073659Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4scsaucho3ich", "record": "CVE-2026-77776", "field": "creation_timestamp", "uuid": "1229fa09-a40e-47a7-aff6-42314ad199c6", "content": "CVE-2026-77776 - Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity\nCVE ID : CVE-2026-77776\n \n Published : Aug. 21, 2026, 11:22 a.m. | 33\u00a0minutes ago\n \n Description : Headroom's LLM proxy derives the memory owner from the x-headroo...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/4scsaucho3ich"}, {"timestamp": "2026-08-21T12:16:36Z", "date_only": false, "value": "2026-08-21T12:16:36Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5VG3-C628-VF56", "record": "GHSA-5VG3-C628-VF56", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-21T12:16:36.967Z", "date_only": false, "value": "2026-08-21T12:16:36.967", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77776", "record": "FKIE_CVE-2026-77776", "field": "published"}, {"timestamp": "2026-08-21T12:30:34Z", "date_only": false, "value": "2026-08-21T12:30:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5VG3-C628-VF56", "record": "GHSA-5VG3-C628-VF56", "field": "published"}, {"timestamp": "2026-08-21T12:30:34Z", "date_only": false, "value": "2026-08-21T12:30:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5VG3-C628-VF56", "record": "GHSA-5VG3-C628-VF56", "field": "modified"}, {"timestamp": "2026-08-21T14:00:54.644Z", "date_only": false, "value": "2026-08-21T14:00:54.644374Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtlwccp76p27", "record": "CVE-2026-77776", "field": "creation_timestamp", "uuid": "40a8d901-23e5-44c6-a7bc-8add6b6b3fb7", "content": "\ud83d\udd34 CVE-2026-77776 - Critical (9.1)\n\nHeadroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The hea...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-77776/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtlwccp76p27"}, {"timestamp": "2026-08-21T14:07:14.177Z", "date_only": false, "value": "2026-08-21T14:07:14.177544Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtlwnnj7k224", "record": "CVE-2026-77776", "field": "creation_timestamp", "uuid": "26ba430b-0cbb-4246-ad3d-d859f81e2450", "content": "\ud83d\udea8 CVE-2026-77776 \u2014 CVSS 9.3 CRITICAL\n\nHeadroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is rea...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-77776\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mtlwnnj7k224"}, {"timestamp": "2026-08-21T15:02:38.049Z", "date_only": false, "value": "2026-08-21T15:02:38.049906Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mtlzqphljc2o", "record": "CVE-2026-77776", "field": "creation_timestamp", "uuid": "615d61f8-89c0-42a4-84bc-07f4868e240b", "content": "CVE-2026-77776 - Critical IDOR in Headroom LLM proxy. Spoof x-headroom-user-id to read/write other users' memory. CVSS 9.1. No patch yet - restrict access now. #CVE #Headroom #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-77776/", "url": "https://bsky.app/profile/hugovalters.bsky.social/post/3mtlzqphljc2o"}, {"timestamp": "2026-08-21T15:02:47.962Z", "date_only": false, "value": "2026-08-21T15:02:47.962479Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/hugovalters/statuses/117134102243290210", "record": "CVE-2026-77776", "field": "creation_timestamp", "uuid": "c80f74ea-30bf-4dcd-a84a-f39fc1d42fef", "content": "CVE-2026-77776 - Critical IDOR in Headroom LLM proxy. Spoof x-headroom-user-id to read/write other users' memory. CVSS 9.1. No patch yet - restrict access now. #CVE #Headroom #infosec\nhttps://www.valtersit.com/cve/CVE-2026-77776/", "url": "https://mastodon.social/users/hugovalters/statuses/117134102243290210"}, {"timestamp": "2026-08-21T21:00:05.936Z", "date_only": false, "value": "2026-08-21T21:00:05.936503Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtmnpvkdmn2b", "record": "CVE-2026-77776", "field": "creation_timestamp", "uuid": "1413b4a3-cb03-4315-b506-afa9708904eb", "content": "CVE-2026-77776 - headroom\nThe Headroom service that sits in front of AI models accepts a custom header called x-headroom-user-id and trusts it to decide whose data to access. Because the service does\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#headroom #headroomlabs #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mtmnpvkdmn2b"}, {"timestamp": "2026-08-21T21:18:54.351Z", "date_only": false, "value": "2026-08-21T21:18:54.351966Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-77776", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-21T21:18:54.351Z", "date_only": false, "value": "2026-08-21T21:18:54.351966Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77776", "record": "FKIE_CVE-2026-77776", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-21T21:44:30.707Z", "date_only": false, "value": "2026-08-21T21:44:30.707Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-77776", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-21T21:44:30.707Z", "date_only": false, "value": "2026-08-21T21:44:30.707Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-77776", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-22T06:40:06.382Z", "date_only": false, "value": "2026-08-22T06:40:06.382825Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtno4xh7n42f", "record": "CVE-2026-77776", "field": "creation_timestamp", "uuid": "7c1783a8-5f20-4b69-a7d9-6baeb6a6f8b7", "content": "CVE-2026-77776\nHeadroom\u2019s language\u2011model gateway decides whose stored data to use based on a request header called x-headroom-user-id. Because the gateway does not verify that the caller actually owns that ID, anyone can send\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mtno4xh7n42f"}, {"timestamp": "2026-10-15T19:10:00.173Z", "date_only": false, "value": "2026-10-15T19:10:00.173", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77776", "record": "FKIE_CVE-2026-77776", "field": "lastModified"}]}