Skip to content
OpenAdvisories

Vendor

letta-ai

7 known vulnerabilities.

Products

letta 6 LettaBot 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-77937

    Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header

    Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, …

    letta-ai letta
  • High 7.3
    CVE-2026-18990

    letta-ai LettaBot API Status Route server.ts missing authentication

    A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit …

    letta-ai LettaBot
  • High 7.3
    CVE-2026-4965

    letta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injection

    A vulnerability was detected in letta-ai letta 0.16.4. This issue affects the function resolve_type of the file letta/functions/ast_parsers.py of the component Incomplete Fix CVE-2025-6101. Performing a manipulation results in improper neutralization of direc…

    letta-ai letta