Letta Server: Missing authentication by default allows unauthenticated API access and RCE

Summary

Letta through version 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is not added and all API routes are unauthenticated. The bundled PostgreSQL port is also published with default superuser credentials. A remote attacker with network access to the server can execute arbitrary Python via the tool-run endpoint, manage admin users, or run OS commands through PostgreSQL COPY PROGRAM.

Affected

• Letta through 0.16.8 (letta-ai/letta)
• Deployments based on the shipped compose.yaml without LETTA_SERVER_SECURE enabled

Fixed in

Unknown. No fixed version has been confirmed by the vendor.

Workaround

• Set LETTA_SERVER_SECURE explicitly to enable authentication in compose.yaml or the environment
• Stop publishing the PostgreSQL port and replace the default database credentials
• Restrict Letta and its database to an internal network

Exploitation

• Public proof of concept: Yes (Lasso write-up)
• In the wild: No evidence found
• CISA SSVC: Exploitation poc, automatable yes, technical impact total

Our recommendation

• Identify all Letta instances, including test and self-hosted deployments, and check whether any are reachable from the internet
• Enable LETTA_SERVER_SECURE and change all default database credentials
• Remove the published database port and restrict access to an internal network
• Monitor the vendor's GitHub releases for a fixed version and apply it as soon as it is available
• Treat internet-exposed instances as high priority

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub: compose.yaml (Letta) github.com
• GitHub: app.py (Letta) github.com
• Lasso Vulnerability Database www.lasso.security
• VulnCheck Advisory www.vulncheck.com
• VulDB vuldb.com
• The Hacker Wire www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:08.