{"metadata": {"vulnerability": "CVE-2026-77936", "count": 15, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-08-21T17:52:36.080Z", "date_only": false, "value": "2026-08-21T17:52:36.080Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-77936", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-18T00:00:00Z", "date_only": false, "value": "2026-10-18T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-77936", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-20T00:46:14.144Z", "date_only": false, "value": "2026-10-20T00:46:14.144Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-77936", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-20T00:46:14.144Z", "date_only": false, "value": "2026-10-20T00:46:14.144Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-77936", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T01:17:20Z", "date_only": false, "value": "2026-10-20T01:17:20Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-G524-HHF9-5X95", "record": "GHSA-G524-HHF9-5X95", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-20T01:17:20.107Z", "date_only": false, "value": "2026-10-20T01:17:20.107", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77936", "record": "FKIE_CVE-2026-77936", "field": "published"}, {"timestamp": "2026-10-20T01:20:23.664Z", "date_only": false, "value": "2026-10-20T01:20:23.664571Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117470607650607813", "record": "cve-2026-77936", "field": "creation_timestamp", "uuid": "a7cee822-bb2b-4704-b041-1f17235a2c3d", "content": "CVE-2026-77936 Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.\nhttps://www.cve.org/CVERecord?id=CVE-2026-77936https://www.lasso.security/vulnerability-database/cve-2026-77936https://github.com/letta-ai/letta/blob/1131535716e8a31c9a437f8695e25ac98f203a24/compose.yaml#L17https://github.com/letta-ai/letta/blob/1131535716e8a31c9a437f8695e25ac98f203a24/letta/server/rest_api/app.py#L799https://www.vulncheck.com/advisories/letta-through-0.16.8-insecure-default-configuration-unauthenticated-api-and-postgresql-access#letta-ai #letta#CVE_2026_77936#bot", "url": "https://infosec.exchange/users/cve/statuses/117470607650607813"}, {"timestamp": "2026-10-20T01:30:25.532Z", "date_only": false, "value": "2026-10-20T01:30:25.532093Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117470647080732116", "record": "cve-2026-77936", "field": "creation_timestamp", "uuid": "c7bae01b-eac1-4329-8823-fc7364385b40", "content": "letta-ai letta <=0.16.8 ships with CRITICAL vuln (CVE-2026-77936): APIs lack auth, superuser PostgreSQL exposed. Attackers can run code & manage users remotely. Update configs & secure now! https://radar.offseq.com/threat/cve-2026-77936-initialization-of-a-resource-with-an-insecure-default-in-letta-ai-letta-1400c5151914a21b #OffSeq #CVE #APIsecurity #Infosec", "url": "https://infosec.exchange/users/offseq/statuses/117470647080732116"}, {"timestamp": "2026-10-20T03:32:45Z", "date_only": false, "value": "2026-10-20T03:32:45Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-G524-HHF9-5X95", "record": "GHSA-G524-HHF9-5X95", "field": "published"}, {"timestamp": "2026-10-20T03:32:45Z", "date_only": false, "value": "2026-10-20T03:32:45Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-G524-HHF9-5X95", "record": "GHSA-G524-HHF9-5X95", "field": "modified"}, {"timestamp": "2026-10-20T16:04:32.766Z", "date_only": false, "value": "2026-10-20T16:04:32.766807Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-77936", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T16:04:32.766Z", "date_only": false, "value": "2026-10-20T16:04:32.766807Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77936", "record": "FKIE_CVE-2026-77936", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-20T16:07:28.161Z", "date_only": false, "value": "2026-10-20T16:07:28.161Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-77936", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-20T16:07:28.161Z", "date_only": false, "value": "2026-10-20T16:07:28.161Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-77936", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T20:06:37.150Z", "date_only": false, "value": "2026-10-20T20:06:37.150", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77936", "record": "FKIE_CVE-2026-77936", "field": "lastModified"}]}