Attack Chain

1. Attacker performs network discovery to identify exposed Letta API ports (default 8283) or PostgreSQL instances (default 5432).
2. Attacker probes the /v1/admin or /v1/tools/run endpoints to confirm the lack of authentication.
3. Attacker accesses the API anonymously to gain insights into the application state or user list.
4. Attacker uses default credentials to gain unauthorized access to the exposed PostgreSQL database instance.
5. Attacker leverages database privileges to perform administrative actions, such as creating or modifying Letta platform users.
6. Attacker sends a POST request to /v1/tools/run containing malicious Python code to achieve remote code execution.
7. Attacker optionally uses PostgreSQL COPY PROGRAM functions to escalate to underlying OS command execution.
8. Attacker achieves persistent access or exfiltrates data from the host environment.

Impact

Successful exploitation allows remote attackers to bypass all authentication controls, leading to total compromise of the Letta instance. Attackers can execute arbitrary code on the application host, gain full administrative control over the platform, and potentially compromise the underlying infrastructure through database-level command execution. This vulnerability is applicable to any enterprise or individual using Letta in a default containerized deployment.

Recommendation

• Immediately upgrade Letta to a version later than 0.16.8 where the compose.yaml has been remediated.
• Update existing container deployments to explicitly set LETTA_SERVER_SECURE to 'true' in all environment configurations.
• Rotate default credentials for any PostgreSQL database instances managed by Letta deployments.
• Restrict network access to the Letta API and the PostgreSQL service to trusted internal IP addresses only.
• Audit logs for unauthorized access to the /v1/admin and /v1/tools/run endpoints.