CVE-2026-77936 is a critical (CVSS 9.8) insecure-default-configuration flaw in Letta's bundled compose.yaml that lets remote, unauthenticated attackers run arbitrary Python, manage admin users, and execute OS commands.
What Is It
Letta through version 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE. Because of this, the server never adds its password middleware, so every API route is left unauthenticated. The same compose file also exposes a PostgreSQL port with superuser access and default credentials.
The NVD record lists three attack paths:
- Run arbitrary Python through
POST /v1/tools/run - Manage users through the
/v1/adminendpoints - Run OS commands through PostgreSQL's
COPY PROGRAM
The weakness is classified as CWE-1188 (Initialization of a Resource with an Insecure Default). VulnCheck disclosed the flaw, and the NVD record has the status "Received."
Why It Matters
The vulnerability scores CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Under CVSS 4.0 it scores 9.3 (Critical). An attacker can exploit it over the network with low complexity, no privileges and no user interaction. Confidentiality, integrity and availability impacts are all rated high.
A deployment that uses the default compose configuration and is reachable by an attacker likely has two separate ways in: the unauthenticated application API and the database. According to the advisory, either one can potentially lead to code or command execution on the host, depending on network exposure and any controls the operator has added.
KEV status: CVE-2026-77936 is not in the supplied CISA KEV data. The supplied sources do not confirm active exploitation.
What's Vulnerable
- Vendor/Product: letta-ai / letta (
pkg:pypi/letta) - Affected versions: all versions from 0 through 0.16.8
- Repository: https://github.com/letta-ai/letta
- Condition: deployments that use the shipped
compose.yamlwithoutLETTA_SERVER_SECUREenabled
The CVE record carries the unsupported-when-assigned tag.
Patch Status
The supplied NVD data does not name a fixed version, and there is no CISA KEV entry with a required action or due date. Operators running Letta 0.16.8 or earlier should check the VulnCheck advisory and the upstream repository for fix guidance. They should also check whether their deployment's configuration enables LETTA_SERVER_SECURE and whether the PostgreSQL port with default credentials can be reached.