Skip to content
Threat Feed
Subscribe

Product

Letta (<= 0.16.8)

1 brief RSS
critical advisory

Insecure Default Configuration in Letta Leading to Unauthenticated RCE

Letta versions through 0.16.8 ship with a insecure compose.yaml that disables authentication middleware and exposes a PostgreSQL database with default credentials, enabling remote code execution and administrative account takeover.

Letta configuration-error remote-code-execution web-application authentication-bypass cloud webserver
4t 1c