CVE-2026-77936

LOWCVSS 9.3 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-1188

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Referenced assets2 URLs

By indicator

Full discourse2 posts

VulnTracker@vuln_tracker20h
Letta CVE-2026-77936 (CVSS 9.8): the default self-hosted setup ships with no authentication. Letta 0.16.8 and earlier: every API route is open, attackers can run arbitrary Python and manage admin users. The exposed PostgreSQL (default credentials, superuser) allows OS commands. No fixed version listed. VulnTracker recommends enabling LETTA_SERVER_SECURE and not publishing the database port. Details: http://vulntracker.io/cves/CVE-2026-77936 #Letta #AI #CVE #InfoSec
0001063
841 followersView on X
The Hacker Wire@TheHackerWire15h
🚨 CVE-2026-77936 (CVSS 9.8 Critical) Letta ships a compose.yaml omitting LETTA_SERVER_SECURE, disabling auth middleware so remote attackers can run arbitrary Python via /v1/tools/run. ⚡ Action: Enable LETTA_SERVER_SECURE=true now. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77936/ https://t.co/jrnHHqgMId
0000017
190 followersView on X

Explore more

Back to dashboard