Letta EUVD-2026-104692

Exploitation requires the target to be deployed using Letta's shipped compose.yaml (versions through 0.16.8) with LETTA_SERVER_SECURE left unset - which is the default - so the password middleware is never registered and every API route is unauthenticated; the same compose file also publishes a PostgreSQL superuser port with default credentials. The attacker needs network reachability to the Letta HTTP API (POST /v1/tools/run, /v1/admin) or to the exposed Postgres port. Limiting factors: the instance must be network-accessible to the attacker (internet-facing or shared network), and an operator who sets LETTA_SERVER_SECURE, changes the DB credentials, or does not expose the Postgres port is not vulnerable via that path; no user interaction or authentication is otherwise needed against the default configuration.

This is a genuine high-priority issue, not an inflated-CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes unauthenticated, network-reachable, low-complexity full compromise, and the description confirms three independent paths to code/command execution (arbitrary Python via POST /v1/tools/run, admin user management via /v1/admin, and OS command execution via PostgreSQL COPY PROGRAM with default superuser credentials). Publicly available exploit code exists (POC=YES) and the issue was reported by VulnCheck, reinforcing that exploitation is practical rather than theoretical. No EPSS score was provided in the input, so a quantitative exploitation-probability signal is MISSING and cannot be compared against the POC signal. The CVE is NOT listed in CISA KEV in the provided data, so there is no evidence of confirmed active exploitation - this is POC availability, which is a distinct and weaker signal than in-the-wild use. No SSVC decision data was provided. The one tempering factor: exploitation depends on the vulnerable default Docker Compose deployment being exposed to a reachable network, so real-world risk scales with how many operators run the shipped compose.yaml on internet-facing or untrusted-LAN hosts.

A remote attacker who can reach a Letta instance deployed via the shipped compose.yaml (with LETTA_SERVER_SECURE unset) sends an unauthenticated POST to /v1/tools/run and executes arbitrary Python on the server, or connects directly to the exposed superuser PostgreSQL port using default credentials and runs OS commands via COPY PROGRAM. No authentication, user interaction, or special privileges are required, and public exploit code is already available, lowering the barrier to opportunistic attacks.