CVE-2026-18990
letta-ai LettaBot API Status Route server.ts missing authentication
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-306 CWE-287 |
| Vendor | letta-ai |
| Product | lettabot |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for letta-ai lettabot
Be the first to know when new high vulnerabilities affecting letta-ai lettabot are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
letta-ai / LettaBot
0.2.0
References
vuldb.com: https://vuldb.com/vuln/386359 vuldb.com: https://vuldb.com/vuln/386359/cti vuldb.com: https://vuldb.com/cve/CVE-2026-18990 vuldb.com: https://vuldb.com/submit/862562 vuldb.com: https://vuldb.com/submit/862622 gist.github.com: https://gist.github.com/YLChen-007/2ba2e586f3d16cb368c8dcd6ef680178
Credits
🔍 JohnChen (VulDB User) VulDB CNA Team