---
id: "CVE-2026-77936"
kind: "vulnerability"
aliases: ["CVE-2026-77936"]
title: "Letta: shipped compose file leaves API and database unauthenticated"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "docker", "letta", "postgresql", "self-hosted"]
not_affected_if: ["auth-required", "default-config", "managed-hosting"]
published_at: "2026-10-20T01:17:20+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T22:39:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77936", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Letta: shipped compose file leaves API and database unauthenticated

The default compose.yaml for Letta does not turn on LETTA_SERVER_SECURE, so the API routes have no password check, and it exposes PostgreSQL with default superuser credentials. An attacker who can reach the server can run arbitrary Python via /v1/tools/run, create admin users, or run OS commands through PostgreSQL COPY PROGRAM.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether compose.yaml sets LETTA_SERVER_SECURE to true and whether ports 8283 and 5432 are published on a reachable interface.
Test with: curl -i http://HOST:8283/v1/admin (an unauthenticated 200 means exposed).

## Fix

Set LETTA_SERVER_SECURE=true and a strong server password, remove the published PostgreSQL port and change the default database credentials; upgrade past 0.16.8 once a fixed release is confirmed in the sources (unknown).

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77936

## Documents

- [mentions] Xuanyuan: Letta CVE-2026-77936 / 77937 advisory (no fixed tag; Docker Hub 0.34.18 not stated as fix) https://xuanyuan.cloud/blog/letta-cve-2026-77936-77937-security-advisory

## From the sources

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_