Permission to run a tool becomes access to the service identity. The report describes a database follow-on using recovered credentials. Its introductory metadata repeats a different tenant flaw, so this record relies on the specific implementation and reproduction sections. Mechanism, preconditions and effects. Letta's local tool subprocess was launched…
Inspect the ClaimsCase · DiggingBeagle record
Letta local tools inherit the server credential environment
Scope
Local execution with sensitive credentials present in the inherited environment.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
CLM-LETTA-TOOL-ENVIRONMENT reports: The detailed CVE-2026-77938 analysis reports that LocalSandbox copies the server environment into user-supplied tool subprocesses, exposing database and configured model-provider credentials. Source SRC-2026-RADAR-LETTA-TOOL-ENVIRONMENT is located at 'Affected Files, Root Cause, PoC and Impact; tool_sandbox/base.py and local_sandbox.py'. The distinctive mechanism begins: Letta's local tool subprocess was launched with a copy of the parent server's environment. Classification: setting=research_demonstration, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=mitigation_available; scoped control or limit: Pass a minimal explicit subprocess environment, run untrusted tools in a separate sandbox with restricted networking, and ensure database secrets are not present in the tool process. Merely masking keys from model prompts leaves os.environ available to executable code. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-LETTA-TOOL-ENVIRONMENT · Letta CVE-2026-77938 local sandbox analysis
At a glance
No independent reproduction or verified fixed release; remote sandbox modes are not assessed.
Limits and uncertaintyFull account
Permission to run a tool becomes access to the service identity. The report describes a database follow-on using recovered credentials. Its introductory metadata repeats a different tenant flaw, so this record relies on the specific implementation and reproduction sections.
Mechanism, preconditions and effects. Letta's local tool subprocess was launched with a copy of the parent server's environment. The published compose setup puts database connection material and model-provider API keys into that environment, so any user who can run tool code through the local backend can retrieve secrets independently of the text permissions shown to an agent. The advisory also demonstrates accessing other tenants' database rows using recovered credentials.
Comparison and evidence limits. This is a process and credential isolation failure once tool execution is permitted. It neither depends on the unverified user_id header nor applies by evidence to an external E2B/Modal backend. The advisory does not show actual stolen production API keys or prove a named patched release.
Claims & evidence
CLM-LETTA-TOOL-ENVIRONMENTThe detailed CVE-2026-77938 analysis reports that LocalSandbox copies the server environment into user-supplied tool subprocesses, exposing database and configured model-provider credentials.supported
Basis: reported finding
- supportsLetta CVE-2026-77938 local sandbox analysisprimary disclosure
Affected Files, Root Cause, PoC and Impact; tool_sandbox/base.py and local_sandbox.py
Controls and mitigations
- Pass a minimal explicit subprocess environment, run untrusted tools in a separate sandbox with restricted networking, and ensure database secrets are not present in the tool process. Merely masking keys from model prompts leaves os.environ available to executable code.
Unknowns and contradictions
- No independent reproduction or verified fixed release; remote sandbox modes are not assessed.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183