What happened
NVD published CVE-2026-18990 (CVSS 7.3, High) on August 6, 2026, describing a missing-authentication vulnerability in LettaBot's API status endpoint, with public exploit code available and no vendor response to the disclosure.
Why it matters
Unauthenticated status endpoints on agent frameworks can leak internal configuration and operational details useful for follow-on attacks, and the vendor's non-response leaves users without an official fix path.
Attack vector
The API Status Route in src/api/server.ts lacks any authentication check, allowing a remote unauthenticated attacker to query agent/server status information; a public exploit is available.
Affected systems
letta-ai LettaBot 0.2.0
Mitigation
No vendor response reported as of disclosure; deploy behind an authenticating reverse proxy pending patch.