CVE-2026-77938
MediumCVSS 6.5Summary
Letta through 0.16.8 contains an information disclosure vulnerability because LocalSandbox subprocesses inherit the full server environment. Users running tools can read server secrets such as LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.
Risk Assessment
An authenticated user can exfiltrate database credentials and API keys, leading to exposure of other tenants' data. The impact may include full access to data and services in a multi-tenant environment.
Recommendation
Upgrade Letta to a version later than 0.16.8 that restricts environment inheritance by LocalSandbox. Until then, limit tool execution capabilities and rotate any exposed secrets.
Other vulnerabilities in Letta
See all- CVE-2026-77937High
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.
- CVE-2026-77936Critical
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.
Original NVD description (English source)
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS