---
id: "CVE-2026-77938"
kind: "vulnerability"
aliases: ["CVE-2026-77938"]
title: "Letta: tool sandbox leaks server secrets and database credentials to users"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "letta", "postgres", "self-hosted"]
not_affected_if: ["auth-required", "single-tenant-trusted-users"]
published_at: "2026-10-20T01:17:20+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T03:34:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77938", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Letta: tool sandbox leaks server secrets and database credentials to users

Letta through 0.16.8 runs tool code in LocalSandbox subprocesses that inherit the full server environment. A user who can run tools can read LETTA_PG_URI, POSTGRES_PASSWORD and provider API keys, then reach cross-tenant database data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Letta server version with `letta --version` or the image tag; versions through `0.16.8` are listed as affected.
- Confirm whether tool execution is reachable: `POST /v1/tools/run` or custom tools are enabled for non-admin users.
- Look for `LocalSandbox` use in the deployment (default local sandbox, not a remote one).

## Fix

- Upgrade Letta past `0.16.8`; the sources do not name the fixed version, so check the release notes.
- Until patched, restrict who can create or run tools and rotate `LETTA_PG_URI`, `POSTGRES_PASSWORD` and provider API keys.
- Move tool execution to an isolated sandbox that does not inherit the server environment.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77938

## From the sources

Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_