CVE-2026-77936Critical· 9.8▾ MidnightLetta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Re…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.
letta <= 0.16.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77937High· 8.1Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header
CVE-2026-77938Medium· 6.5Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance
CVE-2024-39025High· 7.5Letta (previously MemGPT) incorrect access control vulnerability
CVE-2022-2196Medium· 5.8A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) adv…
CVE-2026-77934High· 8.8Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner
CVE-2026-109437Critical· 9.8Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend