Letta: Cross-tenant impersonation via self-asserted user_id header
Summary
Letta through 0.16.8 trusts a user_id HTTP header to decide which tenant a request belongs to, without verifying it against any credential. An API caller who knows or guesses another tenant's user_id can read and modify that tenant's agents, memory and configuration. Enabling LETTA_SERVER_SECURE does not prevent this, because the shared admin secret does not bind the caller to a tenant.
Affected
- Letta through 0.16.8
- Vulnerable code: letta/server/rest_api/dependencies.py (around line 39)
Fixed in
Unknown. No vendor advisory or fixed version has been confirmed.
Workaround
- No vendor-confirmed workaround.
- Do not rely on LETTA_SERVER_SECURE as a mitigation.
- Keep the Letta API off the public internet and restrict access to trusted internal clients.
- Place a reverse proxy in front of Letta that strips or overwrites client-supplied user_id headers (operator analysis, not from the vendor).
Exploitation
- No confirmed in-the-wild exploitation found.
- A public write-up by Lasso documents a reproduction, including a cross-tenant write via tool execution.
- CISA SSVC: exploitation PoC, not automatable, total technical impact.
- EPSS about 0.4% (Verno index).
Our recommendation
- Inventory whether Letta is deployed, especially internet-facing or multi-tenant instances.
- Restrict network access to the Letta API and apply the reverse proxy header filtering above.
- Monitor logs for unusual or foreign user_id header values.
- Assess data protection impact if personal data is held in agent memory (revDSG/nDSG).
- Ask Letta for a fixed version and apply it as soon as it is published.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Lasso vulnerability database: CVE-2026-77937 www.lasso.security
- VulnCheck advisory: Letta cross-tenant impersonation www.vulncheck.com
- Letta source code: dependencies.py line 39 github.com
- VulDB: CVE-2026-77937 vuldb.com
- Letta 0.16.8 release github.com
- Verno Labs index (EPSS) vernolabs.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:44.
Original description (NVD)
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.