CVE-2026-77936

Letta through 0.16.8 ships a compose.yaml that does not enable LETTASERVERSECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST...