[ Vendor · 3 CVEs ]
letta-ai
CVEs affecting letta-ai published in the last 30 days, plus any letta-ai CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-77936 | 20 Oct 2026 | CVSS 9.8 | letta-ai lettaLetta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are… | |
| CVE-2026-77937 | 20 Oct 2026 | CVSS 8.1 | letta-ai lettaLetta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted… | |
| CVE-2026-77938 | 20 Oct 2026 | CVSS 6.5 | letta-ai lettaLetta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox… |