---
id: "CVE-2026-77937"
kind: "vulnerability"
aliases: ["CVE-2026-77937"]
title: "Letta: user_id header lets API callers impersonate other tenants"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "letta", "fixed": [], "affected": "<= 0.16.8", "ecosystem": "pypi"}]
ecosystems: []
tags: ["ai-tooling", "auth-bypass", "letta", "multi-tenant", "self-hosted"]
not_affected_if: ["api-not-exposed", "single-tenant", "single-user-deployment", "version-above-0.16.8"]
published_at: "2026-10-20T01:17:20+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T22:42:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77937", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:42:05+00:00"}]
---

# Letta: user_id header lets API callers impersonate other tenants

Letta's REST API takes the acting tenant from a client-supplied user_id HTTP header (get_headers in letta/server/rest_api/dependencies.py) and never checks it against a credential. LETTA_SERVER_SECURE only adds one shared password, so any caller who has it, or anyone at all when secure mode is off, can read and modify another tenant's agents, memory and configuration by setting user_id. Affected: through 0.16.8. No fixed version has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:letta affected <= 0.16.8 fixed ?

## How to check

Run a self-hosted Letta server at <= 0.16.8 (docker image letta/letta tag, or pip show letta on the server host). Multi-tenant exposure: with the API reachable, send a request with header 'user_id: user-<other tenant id>' and see whether you get that tenant's agents. Check whether your gateway forwards a client-supplied user_id header to Letta.

## Fix

No fixed version published by the maintainer as of 2026-10-23 (GitHub release latest is 0.16.8; Docker Hub 0.34.18 not confirmed as a fix). Mitigate: have the gateway or reverse proxy strip any client user_id header and set it itself from authenticated identity; do not expose the API to untrusted callers; do not rely on Letta for tenant isolation (run one instance per tenant); set LETTA_SERVER_SECURE=true and rotate the shared password. Recheck the letta-ai/letta releases.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77937
- 2026-10-23T22:42:05+00:00 analyst — Read Lasso and VulnCheck advisories and the dependencies.py source. No vendor fix named: affected is 'through 0.16.8', GitHub release still 0.16.8, a Docker Hub 0.34.18 is not stated as a fix (secondary blog only). Auth: needs a valid caller (CVSS PR:L); with LETTA_SERVER_SECURE only a shared admin secret exists, so any holder of it can pick any tenant by user_id. With secure mode off (default compose) no key at all is needed (see sibling CVE-2026-77936). No PoC or exploitation reported; not in KEV. Note PyPI 'letta' is now the Letta Code CLI, not the server.

## Documents

- [advisory] Lasso Security: CVE-2026-77937 Cross-Tenant Impersonation via Self-Asserted user_id Header https://www.lasso.security/vulnerability-database/cve-2026-77937
- [advisory] VulnCheck: Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header https://www.vulncheck.com/advisories/letta-through-0.16.8-cross-tenant-impersonation-via-user-id-header
- [describes] letta dependencies.py: get_headers takes actor_id from user_id header https://github.com/letta-ai/letta/blob/1131535716e8a31c9a437f8695e25ac98f203a24/letta/server/rest_api/dependencies.py
- [mentions] Xuanyuan: Letta CVE-2026-77936 / 77937 advisory (no fixed tag; Docker Hub 0.34.18 not stated as fix) https://xuanyuan.cloud/blog/letta-cve-2026-77936-77937-security-advisory

## From the sources

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_