CVE-2026-77936
CriticalCVSS 9.8Summary
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.
Risk Assessment
The organization is exposed to full compromise of the application and database by unauthenticated attackers, including arbitrary code and OS command execution.
Recommendation
Update Letta to a version later than 0.16.8, enable LETTA_SERVER_SECURE, change default PostgreSQL credentials, and restrict access to the database port.
Other vulnerabilities in Letta
See all- CVE-2026-77938Medium
Letta through 0.16.8 contains an information disclosure vulnerability because LocalSandbox subprocesses inherit the full server environment. Users running tools can read server secrets such as LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.
- CVE-2026-77937High
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.
Original NVD description (English source)
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS