The request can authenticate while its tenant selector remains untrusted. The reported test contrasts authorized tenant scoping with an asserted victim identity, exposing agent data and memory. Protecting the server entrance therefore does not establish authorization for each tenant resource. Mechanism, preconditions and effects. Letta's API derived…
Inspect the ClaimsCase · DiggingBeagle record
Letta accepts a caller-selected tenant identity even with shared-secret authentication
Scope
Requires a reachable API and a known or guessed victim user ID; secure mode additionally requires the shared credential.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
CLM-LETTA-TENANT-HEADER reports: The CVE-2026-77937 advisory reports cross-tenant access through an unverified user_id header; enabling the shared admin secret does not bind that identifier to the caller. Source SRC-2026-RADAR-LETTA-TENANT-HEADER is located at 'Root Cause and PoC; dependencies.py and user_manager.py'. The distinctive mechanism begins: Letta's API derived agent-owner identity from a user_id request header that the client could choose. Classification: setting=research_demonstration, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=unknown; scoped control or limit: Derive tenant identity from a verified per-tenant credential or server-side session and enforce resource ownership on every operation. A shared administrator secret cannot prove which tenant a particular caller is entitled to control. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-LETTA-TENANT-HEADER · Letta CVE-2026-77937 tenant identity advisory
At a glance
Deployment prevalence and the corrected release were not established.
Limits and uncertaintyFull account
The request can authenticate while its tenant selector remains untrusted. The reported test contrasts authorized tenant scoping with an asserted victim identity, exposing agent data and memory. Protecting the server entrance therefore does not establish authorization for each tenant resource.
Mechanism, preconditions and effects. Letta's API derived agent-owner identity from a user_id request header that the client could choose. The advisory demonstrated reading another tenant's agent list and modifying its records by keeping the valid server session while changing the header. LETTA_SERVER_SECURE's common password authenticates access to the server, but does not bind that caller to the asserted tenant.
Comparison and evidence limits. This differs from default unauthenticated execution: network authentication can be present while authorization between tenants is still absent. The exploit requires knowing or finding an appropriate target user_id, not a specific LLM prompt response, and the proof is a controlled demonstration rather than confirmed production abuse.
Claims & evidence
CLM-LETTA-TENANT-HEADERThe CVE-2026-77937 advisory reports cross-tenant access through an unverified user_id header; enabling the shared admin secret does not bind that identifier to the caller.supported
Basis: reported finding
- supportsLetta CVE-2026-77937 tenant identity advisoryprimary disclosure
Root Cause and PoC; dependencies.py and user_manager.py
Controls and mitigations
- Derive tenant identity from a verified per-tenant credential or server-side session and enforce resource ownership on every operation. A shared administrator secret cannot prove which tenant a particular caller is entitled to control.
Unknowns and contradictions
- Deployment prevalence and the corrected release were not established.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183