CVE-2026-77937
HighCVSS 8.1Summary
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.
Risk Assessment
An attacker can gain unauthorized access to and modify other tenants' data and configuration.
Recommendation
Update Letta to a version later than 0.16.8 that fixes the authentication bypass.
Other vulnerabilities in Letta
See all- CVE-2026-77938Medium
Letta through 0.16.8 contains an information disclosure vulnerability because LocalSandbox subprocesses inherit the full server environment. Users running tools can read server secrets such as LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.
- CVE-2026-77936Critical
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.
Original NVD description (English source)
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS