CVE-2026-18990
Received Received - Intake

Authentication Bypass in LettaBot API

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulDB

Description
A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-18990
EUVD
EUVD-2026-53700

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18990 is an authentication bypass vulnerability in LettaBot 0.2.0. When the agent conversation mode is set to 'shared' (the default), the API fails to enforce API key validation for certain read endpoints. This allows unauthenticated access to sensitive management metadata via endpoints like GET /api/v1/pairing/:channel and GET /api/v1/status.

Detection Guidance

Check if the LettaBot HTTP API is accessible without authentication. Use curl to query the vulnerable endpoints: curl -v http://<target-ip>:<port>/api/v1/pairing/:channel and curl -v http://<target-ip>:<port>/api/v1/status. If responses return 200 OK with sensitive data, the system is vulnerable.

Impact Analysis

An attacker could exploit this to query sensitive metadata without authentication. This includes pairing request listings and agent status details such as agentId, conversationId, channels, baseUrl, and timestamps. The impact includes potential exposure of deployment topology, active channels, and service base URLs.

Mitigation Strategies

Disable the shared conversation mode in LettaBot configuration and switch to per-channel mode. Ensure API key validation is enforced for all endpoints. Restrict network access to the HTTP API port if possible. Update to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18990. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart