CVE-2026-18990

HIGH

letta-ai LettaBot API Status Route server.ts missing authentication

Title source: cna
STIX 2.1

Description

A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (6)

Core 6
Core References
Vdb Entry vdb-entry
VDB-386359 | letta-ai LettaBot API Status Route server.ts missing authentication
https://vuldb.com/vuln/386359
Signature, Permissions Required signature permissions-required
VDB-386359 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/386359/cti
Third Party Advisory third-party-advisory
CVE-2026-18990 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-18990
Third Party Advisory third-party-advisory
Submit #862562 | letta-ai LettaBot 0.2.0 Missing Authentication for Critical Function (CWE-306)
https://vuldb.com/submit/862562
Third Party Advisory third-party-advisory
Submit #862622 | letta-ai lettabot v0.2.0-alpha.13 Missing Authentication for Critical Function (CWE-306) (Duplicate)
https://vuldb.com/submit/862622

Scores

CVSS v3 7.3
EPSS 0.0040
EPSS Percentile 32.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-287 CWE-306
Status published
Products (1)
letta-ai/LettaBot 0.2.0
Published Aug 06, 2026
Tracked Since Aug 06, 2026