Letta 0.16.8 Critical Flaw Exposes Unauthenticated API and Database Access

The Letta AI framework contains a critical security flaw in versions up to 0.16.8 that allows remote attackers to execute arbitrary code and manage system users without authentication. The vulnerability, tracked as CVE-2026-77936, stems from a misconfiguration in the default Docker Compose file that disables essential security middleware.

According to the National Vulnerability Database (NVD), the issue arises because the shipped compose.yaml file does not enable the LETTA_SERVER_SECURE environment variable. This omission prevents the password middleware from being added to the application, resulting in all API routes remaining unauthenticated. The NVD assigns the vulnerability a CVSS score of 9.3, categorizing it as critical.

Technical Details of the Vulnerability

The lack of authentication exposes multiple attack vectors within the Letta application. Remote attackers can send POST requests to the /v1/tools/run endpoint to execute arbitrary Python code on the server. Additionally, the unauthenticated /v1/admin endpoint allows adversaries to create, modify, or delete administrative users, effectively granting them full control over the application.

The vulnerability also extends to the database layer. The default configuration exposes a superuser PostgreSQL port with default credentials. Attackers can leverage this exposure to run operating system commands by using the COPY PROGRAM feature, which allows data export functionality to be abused for command execution. This combination of unauthenticated API access and exposed database credentials creates a severe risk for systems running affected versions.

Affected Versions and Scope

The vulnerability affects all versions of the letta-ai Letta framework up to and including version 0.16.8. The NVD record identifies the weakness as CWE-1188, which relates to authentication bypass due to default credentials or configuration errors. Any deployment using the default compose.yaml file without manually enabling the LETTA_SERVER_SECURE variable is vulnerable to these attacks.

This incident follows a pattern of configuration errors leading to severe access issues in web applications. For instance, Threat Times reported on October 19, 2026, that FlyCms suffered a critical flaw allowing unauthenticated admin access via default credentials. While the technical mechanisms differ, both cases highlight the risks of insecure default configurations in popular software packages.

What should you do?

Organizations using Letta should immediately audit their deployments for versions 0.16.8 and earlier. Administrators should verify that the LETTA_SERVER_SECURE variable is enabled in their compose.yaml files to ensure password middleware is active. Until a patched version is released, users should restrict network access to the Letta API endpoints and the PostgreSQL port to trusted sources only.