Letta versions up to 0.16.8 ship a default compose configuration that omits the LETTA_SERVER_SECURE setting, leaving the password middleware disabled. All API routes are therefore unauthenticated, and the service exposes a PostgreSQL instance with superuser access using the default credentials. A remote attacker can exploit the exposed API endpoints to run arbitrary Python code via POST /v1/tools/run, manipulate admin users through /v1/admin endpoints, or execute operating‑system commands via the COPY PROGRAM command of PostgreSQL. This vulnerability is a severe flaw in internal authentication control (CWE‑1188) and provides full remote code execution capability.

The product impacted is Letta (letta-ai). Versions 0.16.8 and earlier are affected; any deployment using these releases without disabling the default PostgreSQL privileged account is vulnerable.

The CVSS score is 9.3, indicating critical severity, while no EPSS score is currently available. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, exploiting exposed API routes over the network and the PostgreSQL port, enabling attackers to run arbitrary code on the host unless mitigated.