CVE-2026-71416: Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket

Headroom is a tool that compresses data before sending it to an LLM (large language model, an AI system trained on text). In versions before 0.35.0, the Headroom WebSocket server (a communication protocol allowing real-time two-way data exchange) failed to validate the Origin header (a security check that confirms where a request is coming from), allowing attackers to send unauthorized LLM requests and potentially access OpenAI API keys stored in environment variables (system settings that store sensitive information).