CVE-2026-77936 in Letta
Tóm tắt
Bởi VulDB • 20/10/2026
Letta versions up to 0.16.8 ship a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.