Description
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.
Published: 2026-10-20
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Description Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.
Title Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance
First Time appeared Letta
Letta letta
Weaknesses CWE-526
CPEs cpe:2.3:a:letta:letta:*:*:*:*:*:*:*:*
Vendors & Products Letta
Letta letta
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Letta Letta
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-20T00:46:15.564Z

Reserved: 2026-08-21T17:52:36.080Z

Link: CVE-2026-77938

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T01:17:20.410

Modified: 2026-10-20T01:17:20.410

Link: CVE-2026-77938

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-526

    Cleartext Storage of Sensitive Information in an Environment Variable