High 8.1Published Oct 20, 2026

CVE-2026-77937Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header

Updated under an hour ago (2026-10-21 05:40 UTC)

Does this affect you?

It affects letta-ai letta. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for letta-ai letta

Exploited in the last 30 days

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-639
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 20, 2026
First seen by InfoSec Signals: Oct 20, 2026

Affected products

Affected products

letta-ai letta letta_ai:letta (from the name)	through 0.16.8	CNA record

References

https://www.lasso.security/vulnerability-database/cve-2026-77937technical-description, exploit
https://github.com/letta-ai/letta/blob/1131535716e8a31c9a437f8695e25ac98f203a24/letta/server/rest_api/dependencies.py#L39technical-description
https://www.vulncheck.com/advisories/letta-through-0.16.8-cross-tenant-impersonation-via-user-id-headerthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.