CVE-2026-77937
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Oct 20, 2026
Vendor
unknown
Description
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.