{"id":"CVE-2026-77936","kind":"vulnerability","aliases":["CVE-2026-77936"],"related":[],"title":"Letta: shipped compose file leaves API and database unauthenticated","description":"Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.","summary":"The default compose.yaml for Letta does not turn on LETTA_SERVER_SECURE, so the API routes have no password check, and it exposes PostgreSQL with default superuser credentials. An attacker who can reach the server can run arbitrary Python via /v1/tools/run, create admin users, or run OS commands through PostgreSQL COPY PROGRAM.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","docker","letta","postgresql","self-hosted"],"not_affected_if":["auth-required","default-config","managed-hosting"],"how_to_check":"Check whether compose.yaml sets LETTA_SERVER_SECURE to true and whether ports 8283 and 5432 are published on a reachable interface.\nTest with: curl -i http://HOST:8283/v1/admin (an unauthenticated 200 means exposed).","fix":"Set LETTA_SERVER_SECURE=true and a strong server password, remove the published PostgreSQL port and change the default database credentials; upgrade past 0.16.8 once a fixed release is confirmed in the sources (unknown).","status":"open","published_at":"2026-10-20T01:17:20+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:39:41+00:00","updated_at":"2026-10-23T22:39:41+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:39:41Z","model":"claude-haiku-5-5","output":{"fix":"Set LETTA_SERVER_SECURE=true and a strong server password, remove the published PostgreSQL port and change the default database credentials; upgrade past 0.16.8 once a fixed release is confirmed in the sources (unknown).","reach":"internet","title":"Letta: shipped compose file leaves API and database unauthenticated","impact":"high","summary":"The default compose.yaml for Letta does not turn on LETTA_SERVER_SECURE, so the API routes have no password check, and it exposes PostgreSQL with default superuser credentials. An attacker who can reach the server can run arbitrary Python via /v1/tools/run, create admin users, or run OS commands through PostgreSQL COPY PROGRAM.","category":"ai-tooling","who_cares":["letta","self-hosted","docker","postgresql"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary code on the server and reads or changes all data.","analyst_note":"Confirm the fixed version and whether the shipped compose.yaml is still the default in the Letta repository (source: https://nvd.nist.gov/vuln/detail/CVE-2026-77936).","how_to_check":"Check whether compose.yaml sets LETTA_SERVER_SECURE to true and whether ports 8283 and 5432 are published on a reachable interface.\nTest with: curl -i http://HOST:8283/v1/admin (an unauthenticated 200 means exposed).\nunknown for the exact default port mapping in the sources.","needs_analyst":true,"not_affected_if":["managed-hosting","auth-required","default-config"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000599,"input_tokens":2984,"output_tokens":601,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-77936':12A,15A '/v1/admin':123C '/v1/tools/run':65B,121C '0.16.8':79C 'add':96C 'admin':67B 'ai':17B 'ai-tool':16B 'api':6A,39B,99C 'arbitrari':62B,117C 'attack':54B,114C 'check':44B 'command':72B,128C 'compos':3A 'compose.yaml':27B,82C 'copi':75B,130C 'creat':66B 'credenti':52B,112C 'cve':10A,13A 'databas':8A 'default':26B,50B,111C 'docker':19B 'enabl':86C 'execut':116C 'expos':47B,105C 'file':4A 'host':24B 'leav':5A 'letta':1A,20B,29B,34B,77C,87C 'manag':122C 'middlewar':93C 'never':95C 'os':71B,127C 'password':43B,92C 'port':109C 'post':120C 'postgresql':21B,48B,74B,108C 'program':76B,131C 'python':63B,118C 'reach':57B 'remot':113C 'rout':40B,100C 'run':61B,70B,126C 'secur':36B,89C 'self':23B 'self-host':22B 'server':35B,59B,88C 'ship':2A,80C 'superus':51B,107C 'tool':18B 'turn':32B 'unauthent':9A,102C 'user':68B,124C 'via':64B,119C,129C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77936","severity":null,"published_at":"2026-10-20T01:17:20+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[{"id":1569,"url":"https://xuanyuan.cloud/blog/letta-cve-2026-77936-77937-security-advisory","title":"Xuanyuan: Letta CVE-2026-77936 / 77937 advisory (no fixed tag; Docker Hub 0.34.18 not stated as fix)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}