CVE-2026-77938: Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance

Published Oct 20, 2026

Updated

Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTAPGURI, POSTGRESPASSWORD, and provider API keys, then access cross-tenant database data.

Affected Software

0 affected components

Event History

Oct 20, 2026

CVE Published

via MITRE·12:46 AM

Data Sourced

via MITRE·12:46 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A user who can run tools through POST /v1/tools/run or execute custom tools can exploit it. The attacker needs only low-level privileges and does not require user interaction.

What information can be exposed?

Tool-running code can read secrets inherited by LocalSandbox subprocesses, including LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys. Exposed database credentials may enable access to data belonging to other tenants.

Are deployments using the LocalSandbox affected by default?

LocalSandbox subprocesses inherit the full server environment, so deployments that run tools through this sandbox may expose any secrets present in the server environment. The issue affects Letta through version 0.16.8.

CVE-2026-77938: Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are deployments using the LocalSandbox affected by default?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Are deployments using the LocalSandbox affected by default?