The affected boundary is the self-hosted agent service. An API client reaches execution and administrative functions without first establishing an authorized principal. This is separate from both tenant impersonation and secrets inherited by an already admitted tool. Mechanism, preconditions and effects. Letta's self-hosted compose defaults omit the…
Inspect the ClaimsCase · DiggingBeagle record
Letta default self-hosting exposes the agent execution service without authentication
Scope
A reachable instance using the reported default deployment. Network exposure remains a prerequisite.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
CLM-LETTA-DEFAULT-AUTH reports: The CVE-2026-77936 advisory reports that the shipped Letta deployment omits the secure-server setting, allowing unauthenticated API access including user-supplied Python execution. Source SRC-2026-RADAR-LETTA-DEFAULT-AUTH is located at 'Overview, Root Cause and PoC; compose.yaml and /v1/tools/run'. The distinctive mechanism begins: Letta's self-hosted compose defaults omit the secure-server switch, so the password middleware is never installed. Classification: setting=research_demonstration, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=mitigation_available; scoped control or limit: Enable real authentication before exposing endpoints, disable anonymous tool execution and admin APIs, remove external database port publication, and use a non-superuser database role. These are recommended configuration controls; the pinned record does not establish the first corrected upstream release. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-LETTA-DEFAULT-AUTH · Letta CVE-2026-77936 deployment advisory
At a glance
No live exploitation or independently tested remediation is established here.
Limits and uncertaintyFull account
The affected boundary is the self-hosted agent service. An API client reaches execution and administrative functions without first establishing an authorized principal. This is separate from both tenant impersonation and secrets inherited by an already admitted tool.
Mechanism, preconditions and effects. Letta's self-hosted compose defaults omit the secure-server switch, so the password middleware is never installed. This leaves tool source execution and administrative organization/user management endpoints accessible to any caller with network reachability. The shipped database also uses a superuser role and a published port, permitting further control inside the database container when the related credentials are available.
Comparison and evidence limits. The laboratory evidence concerns the shipped default configuration, not every hardened or separately protected deployment. It does not prove that public Letta services were compromised. Tenant header spoofing remains a separate authorization weakness even when the shared server password is enabled.
Claims & evidence
CLM-LETTA-DEFAULT-AUTHThe CVE-2026-77936 advisory reports that the shipped Letta deployment omits the secure-server setting, allowing unauthenticated API access including user-supplied Python execution.supported
Basis: reported finding
- supportsLetta CVE-2026-77936 deployment advisoryprimary disclosure
Overview, Root Cause and PoC; compose.yaml and /v1/tools/run
Controls and mitigations
- Enable real authentication before exposing endpoints, disable anonymous tool execution and admin APIs, remove external database port publication, and use a non-superuser database role. These are recommended configuration controls; the pinned record does not establish the first corrected upstream release.
Unknowns and contradictions
- No live exploitation or independently tested remediation is established here.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183