Letta EUVD-2026-104694

Requires (1) an authenticated account with privileges to execute tools - the attacker must be able to call POST /v1/tools/run or register/run a custom tool (PR:L, so not anonymous); and (2) the deployment must use the LocalSandbox tool-execution backend, where tools run as local subprocesses that inherit the parent server's environment variables, rather than an isolated/remote sandbox (e.g. E2B) that does not pass through LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys. Impact is greatly amplified in MULTI-TENANT deployments where a single shared Postgres holds multiple tenants' data, since the leaked LETTA_PG_URI/POSTGRES_PASSWORD then grants cross-tenant access. Limiting factors: single-tenant deployments, instances running tools in a properly isolated sandbox, or configurations that scrub secrets from the tool environment are not exposed to cross-tenant data theft; exploitation also depends on the attacker already holding valid tool-execution credentials.

This is a moderate-priority confidentiality flaw whose real-world risk hinges on deployment model rather than raw reachability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 7.1 score indicate a network-reachable, low-complexity attack that nonetheless REQUIRES authentication (PR:L) - exploitation is not anonymous. Impact is confined to confidentiality (VC:H, with VI:N/VA:N), consistent with CWE-526 (sensitive information exposed via environment variables): the attacker reads secrets, they cannot directly tamper or destroy. The vector reports SC:N (no subsequent-system impact), yet the description explicitly states that stolen DB credentials enable 'cross-tenant database data' access - this is a notable TENSION: the scored vector arguably under-weights the downstream multi-tenant breach, so the effective business impact is higher than the base metrics suggest. Public exploit code exists (reported by VulnCheck and Lasso Security) which raises the practical likelihood of use, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of widespread automated exploitation - treat it as a credible, documented technique rather than mass-exploited. Net: prioritize for any multi-tenant Letta deployment running the LocalSandbox, deprioritize for single-tenant or fully-sandboxed setups.

An authenticated low-privilege user on a shared, multi-tenant Letta instance submits code through POST /v1/tools/run or registers a custom tool; because the LocalSandbox subprocess inherits the full server environment, the code simply reads environment variables to harvest LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys. The attacker then uses the leaked Postgres connection string to query the shared database directly and read other tenants' data. Public proof-of-concept/exploit material is available (VulnCheck/Lasso Security), lowering the effort to reproduce this network-reachable, low-complexity attack.