CVE-2026-18990 is a vulnerability in letta-ai LettaBot version 0.2.0, specifically in the API Status Route component within the file src/api/server.ts. The vulnerability causes missing authentication, allowing remote attackers to bypass authentication mechanisms. The vendor was contacted but did not respond, and no patch or remediation has been published. The vulnerability has a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating it is exploitable remotely without privileges or user interaction and impacts confidentiality, integrity, and availability to a limited extent. Public exploit code is available, but no known exploitation in the wild has been reported.

The vulnerability allows remote attackers to bypass authentication controls in the affected API component, potentially leading to unauthorized access with limited impact on confidentiality, integrity, and availability. Since the authentication is missing, attackers could interact with the API without proper authorization, which may lead to information disclosure or modification and service disruption.

No official patch or remediation has been provided by the vendor, and the vendor has not responded to disclosure attempts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to the affected API endpoint or implementing additional external authentication controls as a temporary mitigation.