Evidence · DiggingBeagle record
Letta CVE-2026-77936 deployment advisory
- Source role
- primary disclosure
Evidence record
Claim-level citations (1)
- supportsLetta default self-hosting exposes the agent execution service without authentication: The CVE-2026-77936 advisory reports that the shipped Letta deployment omits the secure-server setting, allowing unauthenticated API access including user-supplied Python execution.
Overview, Root Cause and PoC; compose.yaml and /v1/tools/run