CVE-2026-77937: Security vulnerability
Published Oct 20, 2026
·Updated
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted userid HTTP header. Attackers can set userid to another tenant's ID, even with LETTASERVERSECURE enabled, to read and modify that user's agents, memory and configuration.
Affected Software
0 affected components
Event History
Oct 20, 2026
CVE Published
via MITRE·12:46 AM
Data Sourced
via MITRE·12:46 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Is the secure server mode affected?
Yes. The bypass works even when LETTA_SERVER_SECURE is enabled, because callers can self-assert a user_id header.
2
What access does an attacker need to exploit this issue?
An attacker needs to be able to make API calls to the Letta server and supply an HTTP user_id header. They can set that header to another tenant's ID to impersonate that user.
3
What could an attacker access or change?
An attacker impersonating another user can read and modify that user's agents, memory, and configuration.