CVE-2026-77937
CVE-2026-77937 · Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.
CVSS 8.6 · Alta · EPSS 0,5%
- Publicación
- Actualización
Productos y versiones afectados
letta
- Versiones
- ≥ 0, ≤ 0.16.8: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://www.lasso.security/vulnerability-database/cve-2026-77937
- https://github.com/letta-ai/letta/blob/1131535716e8a31c9a437f8695e25ac98f203a24/letta/server/rest_api/dependencies.py#L39
- https://www.vulncheck.com/advisories/letta-through-0.16.8-cross-tenant-impersonation-via-user-id-header
- https://nvd.nist.gov/vuln/detail/CVE-2026-77937