Evidence · DiggingBeagle record
Letta CVE-2026-77937 tenant identity advisory
- Source role
- primary disclosure
Evidence record
Claim-level citations (1)
- supportsLetta accepts a caller-selected tenant identity even with shared-secret authentication: The CVE-2026-77937 advisory reports cross-tenant access through an unverified user_id header; enabling the shared admin secret does not bind that identifier to the caller.
Root Cause and PoC; dependencies.py and user_manager.py