CVE-2026-77936
CVE-2026-77936 · Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.
CVSS 9.3 · Crítica · EPSS 0,6%
- Publicación
- Actualización
Productos y versiones afectados
letta
- Versiones
- ≥ 0, ≤ 0.16.8: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://www.lasso.security/vulnerability-database/cve-2026-77936
- https://github.com/letta-ai/letta/blob/1131535716e8a31c9a437f8695e25ac98f203a24/compose.yaml#L17
- https://github.com/letta-ai/letta/blob/1131535716e8a31c9a437f8695e25ac98f203a24/letta/server/rest_api/app.py#L799
- https://www.vulncheck.com/advisories/letta-through-0.16.8-insecure-default-configuration-unauthenticated-api-and-postgresql-access
- https://nvd.nist.gov/vuln/detail/CVE-2026-77936