Letta versions through 0.16.8 contain an information disclosure vulnerability that allows attackers to read sensitive server configuration values. The bug arises because the LocalSandbox subprocesses launched to run user‑supplied tools inherit the complete server environment, exposing environment variables such as LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys. An attacker who can submit code via the POST /v1/tools/run endpoint or by creating a custom tool can thus obtain credentials that enable direct database access and potentially cross‑tenant data theft.

This vulnerability is present in all releases of Letta from the earliest publicly available package up to version 0.16.8 inclusive. No later versions are known to be affected. The product is distributed by letta‑ai under the name letta and can be identified by its cpe string.

The CVSS base score of 7.1 indicates high impact on confidentiality, while the EPSS score is not available and KEV is not listed. The attack vector is remote, requiring only that the attacker can issue a request to the /v1/tools/run API, which is typically exposed on the network. An attacker could exploit this without needing elevated privileges on the host, making it highly actionable for malicious actors.