Letta-ai
Letta-ai Security Releases - October 2026
letta-ai-2026-10 Oct 1, 2026 Source: Vendor
Letta-ai security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-77936
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
9 lines
Showing 1–9 of 9
CVE-2026-77936
BR2026-0000-041469
letta
unclaimed
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser Post...
Credited as Noy Pearl
CVE-2026-77936
BR2026-0000-041470
letta
unclaimed
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser Post...
Credited as Michael Sromin
CVE-2026-77936
BR2026-0000-041471
letta
unclaimed
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser Post...
Credited as Ophir Dror
CVE-2026-77937
BR2026-0000-041472
letta
unclaimed
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id t...
Credited as Noy Pearl
CVE-2026-77937
BR2026-0000-041473
letta
unclaimed
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id t...
Credited as Michael Sromin
CVE-2026-77937
BR2026-0000-041474
letta
unclaimed
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id t...
Credited as Ophir Dror
CVE-2026-77938
BR2026-0000-041475
letta
unclaimed
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. A...
Credited as Noy Pearl
CVE-2026-77938
BR2026-0000-041476
letta
unclaimed
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. A...
Credited as Michael Sromin
CVE-2026-77938
BR2026-0000-041477
letta
unclaimed
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. A...
Credited as Ophir Dror