{"id":"CVE-2026-77938","kind":"vulnerability","aliases":["CVE-2026-77938"],"related":[],"title":"Letta: tool sandbox leaks server secrets and database credentials to users","description":"Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.","summary":"Letta through 0.16.8 runs tool code in LocalSandbox subprocesses that inherit the full server environment. A user who can run tools can read LETTA_PG_URI, POSTGRES_PASSWORD and provider API keys, then reach cross-tenant database data.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","letta","postgres","self-hosted"],"not_affected_if":["auth-required","single-tenant-trusted-users"],"how_to_check":"- Check the Letta server version with `letta --version` or the image tag; versions through `0.16.8` are listed as affected.\n- Confirm whether tool execution is reachable: `POST /v1/tools/run` or custom tools are enabled for non-admin users.\n- Look for `LocalSandbox` use in the deployment (default local sandbox, not a remote one).","fix":"- Upgrade Letta past `0.16.8`; the sources do not name the fixed version, so check the release notes.\n- Until patched, restrict who can create or run tools and rotate `LETTA_PG_URI`, `POSTGRES_PASSWORD` and provider API keys.\n- Move tool execution to an isolated sandbox that does not inherit the server environment.","status":"open","published_at":"2026-10-20T01:17:20+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:34:50+00:00","updated_at":"2026-10-25T03:34:50+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:34:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Letta past `0.16.8`; the sources do not name the fixed version, so check the release notes.\n- Until patched, restrict who can create or run tools and rotate `LETTA_PG_URI`, `POSTGRES_PASSWORD` and provider API keys.\n- Move tool execution to an isolated sandbox that does not inherit the server environment.","reach":"internet","title":"Letta: tool sandbox leaks server secrets and database credentials to users","impact":"high","summary":"Letta through 0.16.8 runs tool code in LocalSandbox subprocesses that inherit the full server environment. A user who can run tools can read LETTA_PG_URI, POSTGRES_PASSWORD and provider API keys, then reach cross-tenant database data.","category":"ai-tooling","nicknames":[],"who_cares":["letta","self-hosted","postgres","ai-agents"],"confidence":0.7,"needs_auth":"yes","worst_case":"Server secrets and database credentials are readable, enabling cross-tenant data access","analyst_note":"Confirm the first fixed Letta version and whether a remote sandbox setting avoids the leak; check the NVD entry and Letta release notes.","how_to_check":"- Check the Letta server version with `letta --version` or the image tag; versions through `0.16.8` are listed as affected.\n- Confirm whether tool execution is reachable: `POST /v1/tools/run` or custom tools are enabled for non-admin users.\n- Look for `LocalSandbox` use in the deployment (default local sandbox, not a remote one).","needs_analyst":true,"not_affected_if":["auth-required","single-tenant-trusted-users"],"who_is_affected":"Deployments of Letta through 0.16.8 where users can run tools, through the tools run endpoint or custom tools, on the local sandbox. The exposure depends on whether untrusted or multi-tenant users can execute tools; single-tenant deployments with only trusted operators carry less risk. unknown whether a remote sandbox setup is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":3341,"output_tokens":740,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-77938':14A,17A '/v1/tools/run':99C '0.16.8':31B,70C 'access':115C 'agent':20B 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'allow':77C 'api':59B,112C 'attack':93C 'code':34B,96C 'contain':71C 'credenti':9A 'cross':64B,117C 'cross-ten':63B,116C 'custom':101C 'cve':12A,15A 'data':67B,120C 'databas':8A,66B,119C 'disclosur':74C 'environ':43B,92C 'full':41B,90C 'host':28B 'inform':73C 'inherit':39B,88C 'key':60B,113C 'leak':4A 'letta':1A,24B,29B,52B,68C,105C 'localsandbox':36B,86C 'password':56B,109C 'pg':53B,106C 'post':98C 'postgr':25B,55B,108C 'provid':58B,111C 'reach':62B 'read':51B,82C,104C 'run':32B,48B,79C,95C 'sandbox':3A 'secret':6A,84C 'self':27B 'self-host':26B 'server':5A,42B,83C,91C 'subprocess':37B,87C 'tenant':65B,118C 'tool':2A,23B,33B,49B,80C,102C 'uri':54B,107C 'user':11A,45B,78C 'via':97C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Letta through 0.16.8 where users can run tools, through the tools run endpoint or custom tools, on the local sandbox. The exposure depends on whether untrusted or multi-tenant users can execute tools; single-tenant deployments with only trusted operators carry less risk. unknown whether a remote sandbox setup is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77938","severity":null,"published_at":"2026-10-20T01:17:20+00:00","modified_at":"2026-10-20T20:11:29+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}