CVE-2026-18990: LettaBot Auth Bypass Vulnerability

CVE-2026-18990 Overview

CVE-2026-18990 is a missing authentication vulnerability in letta-ai LettaBot 0.2.0. The flaw resides in an unspecified function of src/api/server.ts within the API Status Route component. An unauthenticated remote attacker can query the status endpoint without providing credentials. A public proof-of-concept is available on GitHub Gist. The vendor was contacted before disclosure but did not respond. The weakness is classified as [CWE-287] Improper Authentication.

Critical Impact
Remote attackers can access the API Status Route without authentication, exposing service metadata and enabling reconnaissance against LettaBot deployments.

Affected Products

letta-ai LettaBot 0.2.0
Component: API Status Route in src/api/server.ts
Deployments exposing the LettaBot API to untrusted networks

Discovery Timeline

2026-08-06 - CVE-2026-18990 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-18990

Vulnerability Analysis

The vulnerability affects the API Status Route implemented in src/api/server.ts of LettaBot 0.2.0. The route handler does not enforce authentication before returning a response. Any client capable of reaching the API endpoint over the network can invoke the route and receive status data.

The attack requires no privileges, no user interaction, and can be delivered over the network. Exploitation yields limited confidentiality, integrity, and availability impact on the affected service. The public proof-of-concept demonstrates the request pattern needed to trigger the issue.

Root Cause

The API Status Route lacks an authentication middleware or authorization check. Requests reach the handler and return responses without validating any credential, token, or session. This aligns with [CWE-287] Improper Authentication, where a resource that should require identity verification serves anonymous callers.

Attack Vector

An attacker sends an HTTP request directly to the API Status Route of an exposed LettaBot instance. No account, key, or prior access is required. The request returns status information that supports further reconnaissance and profiling of the bot's runtime environment. See the GitHub Gist PoC and the VulDB CVE-2026-18990 entry for the request details.

No verified exploit code is reproduced here.
Refer to the public GitHub Gist proof-of-concept linked above
for the exact request pattern used to trigger the endpoint.

Detection Methods for CVE-2026-18990

Indicators of Compromise

Unauthenticated HTTP requests to the LettaBot API Status Route from external or unexpected source addresses.
Repeated status endpoint probes lacking Authorization headers or session cookies.
Access log entries returning 200 OK on the status route without an associated authenticated user identifier.

Detection Strategies

Inspect reverse-proxy or web server logs for requests to the status path served by src/api/server.ts and flag those without authentication headers.
Correlate spikes in status endpoint traffic with subsequent probing of other LettaBot API routes to identify reconnaissance chains.
Add a rule in your web application firewall to log and alert on any status route access originating outside a defined allowlist.

Monitoring Recommendations

Forward LettaBot access logs to a centralized logging platform and retain them for post-incident review.
Baseline normal request rates to the status route and alert on deviations.
Monitor egress and telemetry from any host running LettaBot 0.2.0 for anomalous outbound activity that could indicate follow-on exploitation.

How to Mitigate CVE-2026-18990

Immediate Actions Required

Restrict network access to LettaBot API endpoints using firewall rules, security groups, or a reverse proxy that only allows trusted callers.
Place LettaBot behind an authenticating gateway that enforces a token or session check before requests reach src/api/server.ts.
Audit existing deployments of LettaBot 0.2.0 for internet exposure and remove public reachability where not required.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry, and the vendor did not respond to disclosure. Track the VulDB vulnerability record #386359 and the project repository for any subsequent fix release. Until a patched version is issued, treat all LettaBot 0.2.0 instances as vulnerable.

Workarounds

Front the LettaBot service with an authenticating reverse proxy such as NGINX, Envoy, or an API gateway that requires a bearer token.
Apply IP allowlisting so only known administrative hosts can reach the status route.
Add an authentication middleware to the Express or equivalent route definition in src/api/server.ts as a local patch until an upstream fix is available.

bash

# Example NGINX snippet restricting the status route
location /status {
    allow 10.0.0.0/8;
    deny all;
    auth_request /_auth;
    proxy_pass http://lettabot_upstream;
}