https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-21T08:32:16.472419+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-77936 CVE-2026-77936 — Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access 2026-10-21T08:32:16.473310+00:00

Affected: letta-ai letta

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.