CVE-2026-77937

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted userid HTTP header. Attackers can set userid to another tenant's ID, even with LETTASERVERSECURE enabled, to read and modify that user's agents,...