CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-77936 — Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECU...

·Source: NIST NVD

Updated:

Executive Summary

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.

Analysis

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM. CVSS Score: 9.8. Published: 2026-10-20T01:17:20.107.

Indicators of Compromise (1)

CVE (1)
CVE-2026-77936
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 20, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Quest Diagnostics Reports Hack on IT System Used by Clients

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/quest-diagnostics-reports-hack-on-system-used-by-clients-image_small-9-a-33185.jpg" align=right hspace=4><b>Medical Testing Lab Told SEC Incident Likely Compromised 'Certain Patient Records'</b><br>Medical testing company Quest Diagnostics has told the U.S. Securities and Exchange Commission that it's responding to a cyber inciden

Bank Info Security
MEDIUMVulnerabilityNEW

Alms For the Cyber Poor: Program Will Help Small Utilities

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/alms-for-cyber-poor-program-will-help-small-utilities-image_small-5-a-33186.jpg" align=right hspace=4><b>Dragos Has Learned That 'Free' Doesn't Always Mean 'Usable'</b><br>Dragos, a pioneer in the operational technology security market, and its new backer, consulting giant Accenture, are teaming up with the Sans Institute training

Bank Info Security
MEDIUMVulnerability

Railway warns devs to rotate secrets after potential breach

Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. [...]

BleepingComputer