Priority MEDIUM 64
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment.
Vulnerabilities
5 records
Priority HIGH 72
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header.
Priority HIGH 81
Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with defaul…
TI-2026-15517 CVE-2026-18990 · GHSA-c8v3-2w4m-9q57
letta-ai LettaBot API Status Route server.ts missing authentication
Priority HIGH 70
A vulnerability was detected in letta-ai LettaBot 0.2.0.
TI-2025-05511 CVE-2025-6101 · GHSA-f28h-v254-c2wx
letta-ai letta interface.py function_message eval injection
Priority MEDIUM 56
A vulnerability classified as critical has been found in letta-ai letta up to 0.4.1.