Threat Intelligence Database

Letta versions up to 0.16.8 have a vulnerability where sensitive server environment variables are exposed to subprocesses. This allows users running tools to read secrets such as database URIs, passwords, and API keys. The flaw arises because LocalSandbox subprocesses inherit the full server environment, enabling attackers to access cross-tenant data by executing code via specific endpoints.

Letta versions up to 0.16.8 have an authentication bypass vulnerability that allows attackers to impersonate other users by setting a user_id HTTP header. This enables unauthorized reading and modification of another tenant's agents, memory, and configuration, even when LETTA_SERVER_SECURE is enabled. The vulnerability has a high severity with a CVSS score of 8.6.

CVE-2026-77936 affects letta-ai letta versions up to 0.16.8, where the default configuration does not enable LETTA_SERVER_SECURE. This omission disables password middleware, leaving all API routes unauthenticated and exposing a superuser PostgreSQL port with default credentials. As a result, remote attackers can execute arbitrary Python code, manage administrative users, or run operating system commands via exposed API endpoints.

A vulnerability was detected in letta-ai letta 0.16.4. This issue affects the function resolve_type of the file letta/functions/ast_parsers.py of the component Incomplete Fix CVE-2025-6101. Performing a manipulation results in improper neutralization of directives in dynamically evaluated code. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-4965

A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function _convert_message_create_to_message of the file letta/helpers/message_helper.py of the component File URL Handler. Such manipulation of the argument ImageContent leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows remote attackers to execute arbitrary Python code and system commands via crafted payloads to the /v1/tools/run endpoint, bypassing intended sandbox restrictions.

HighVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-51482

A vulnerability classified as critical has been found in letta-ai letta up to 0.4.1. Affected is the function function_message of the file letta/letta/interface.py. The manipulation of the argument function_name/function_args leads to improper neutralization of directives in dynamically evaluated code. The exploit has been disclosed to the public and may be used.

MediumVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-6101