CVE-2026-77938 Details

A vulnerability in Letta versions through 0.16.8 allows information disclosure by letting users running tools access sensitive server secrets. This occurs because the LocalSandbox subprocesses inherit the entire server environment. Attackers can exploit this by executing code through the API endpoint POST /v1/tools/run or by using custom tools, to read environment variables such as LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys. With the database credentials, they can access cross-tenant data in the database.

It is recommended to avoid passing the full server environment to LocalSandbox subprocesses. Instead, limit the child process environment to only what is necessary for the tool execution. For multi-tenant or production deployments, use sandbox implementations that provide isolation, such as E2B or Modal, and document that LocalSandbox is not safe for multi-tenant use.