The vulnerability CVE-2026-18990 affects letta-ai LettaBot version 0.2.0. It is caused by missing authentication in an unknown function of the API Status Route component located in src/api/server.ts. This flaw allows an attacker to perform remote attacks without authentication, potentially accessing or manipulating the API. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. Public exploit code exists, but the vendor has not responded or issued a fix.

An unauthenticated remote attacker can exploit this vulnerability to access or manipulate the affected API route in LettaBot 0.2.0. The impact on confidentiality, integrity, and availability is low but still significant enough to warrant caution. The presence of public exploit code increases the risk of exploitation. No known exploits in the wild have been reported yet.

No official fix or patch is currently available from the vendor. Since the vendor has not responded and no remediation level is provided, users should consider implementing compensating controls such as restricting network access to the affected API route or deploying additional authentication mechanisms if possible. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.