Overview

Letta is an open-source platform for building stateful AI agents with long-term memory. The compose.yaml the project ships does not enable LETTA_SERVER_SECURE, so the server never adds its password middleware and every endpoint is open.

‍

That includes POST /v1/tools/run, which executes arbitrary Python source in the server container, and the /v1/admin routes that create and list organizations and users. The bundled PostgreSQL database also runs as a superuser with default credentials and a port published to the host, which allows operating system command execution on the database container.

‍

Because exploitation can occur with no credentials at all against a Letta server deployed with the project's own compose.yaml, giving any network attacker code execution in the server container and control of every tenant's data, self-hosted deployments should enable authentication and stop publishing the database port immediately

‍

Affected Product

letta-ai/letta

‍

Affected Files

• compose.yaml lines 9-17 (default DB credentials, published DB port, absent LETTA_SERVER_SECURE)
• letta/server/rest_api/app.py lines 797-799 (CheckPasswordMiddleware added only when LETTA_SERVER_SECURE=true)
• letta/server/rest_api/routers/v1/tools.py line 385 (run_tool_from_source, POST /v1/tools/run)
• letta/server/rest_api/routers/v1/organizations.py, users.py (mounted at /v1/admin/)
• letta/constants.py line 32 (ADMIN_PREFIX="/v1/admin")
• init.sql lines 5-7 (superuser DB role)

‍

Root Cause

The shipped compose.yaml does not set LETTA_SERVER_SECURE=true, so CheckPasswordMiddleware is never added to the application. All endpoints, including POST /v1/tools/run (which executes arbitrary Python source in the server container) and the /v1/admin/* organization and user management routers, are accessible without any credentials.

‍

The bundled PostgreSQL role is a superuser and its port is published to the host with default credentials (letta:letta), enabling OS command execution on the database container via COPY ... PROGRAM.

‍

PoC

1. Start using the shipped compose.yaml defaults:

‍
docker compose -p lettapoc -f poc-compose.yaml up -d
‍

(repo compose.yaml defaults: creds letta:letta, LETTA_SERVER_SECURE unset;

host ports remapped to 18283/15432 only to avoid local collisions)
‍

2. Confirm no authentication required
curl :18283/v1/health/  -> {"status":"ok"}

3. Enumerate tenants (unauthenticated):
GET /v1/admin/orgs/
GET /v1/admin/users/

4. Create tenants (unauthenticated):
POST /v1/admin/orgs/
POST /v1/admin/users/

5. Execute arbitrary Python in the server container:
POST /v1/tools/run

‍
source_code: read os.environ["LETTA_PG_URI"], connect via pg8000,
SELECT/UPDATE across tenants,
Demonstrated: UPDATE agents SET name=name||'-PWNED'.

6. Confirm DB superuser for OS command execution:

PGPASSWORD=letta psql -h host.docker.internal -p 15432 -U letta -d letta SELECT rolsuper FROM pg_roles WHERE rolname='letta';

‍

Impact

An unauthenticated network attacker can execute arbitrary Python source code inside the server container by posting to POST /v1/tools/run, with no credentials required in the default deployment.

‍

The attacker can enumerate, read, and modify data across all tenants via /v1/admin/*, and can obtain OS command execution on the database container through the bundled superuser PostgreSQL role and its host-published port. All impact is achievable against any self-hosted Letta instance deployed with the shipped compose.yaml defaults.

‍

Suggested Remediation

1. Require authentication by default: ship LETTA_SERVER_SECURE enabled, or refuse to start with a default or empty secret; gate /v1/tools/run and /v1/admin/*.

2. Do not publish the Postgres port to the host by default; do not run the database role as a superuser; generate non-default DB credentials on first run.

‍

Additional Resources

• CVE-2026-77936 record