CVE-2026-77937
CVE-2026-77937 · Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.
CVSS 8.6 · High · EPSS 0.5%
- Published
- Updated
Affected products and versions
letta
- Versions
- ≥ 0, ≤ 0.16.8: Affected (semver)
No fix published
Original sources
- https://www.lasso.security/vulnerability-database/cve-2026-77937
- https://github.com/letta-ai/letta/blob/1131535716e8a31c9a437f8695e25ac98f203a24/letta/server/rest_api/dependencies.py#L39
- https://www.vulncheck.com/advisories/letta-through-0.16.8-cross-tenant-impersonation-via-user-id-header
- https://nvd.nist.gov/vuln/detail/CVE-2026-77937