AI agent vulnerability · Letta
CVE-2024-39025: Letta (previously MemGPT) incorrect access control vulnerability
highCVSS 3.1 7.5GHSA-7p2g-2vxc-5g55
Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data.
Published Dec 27, 2024 · Updated Jan 2, 2025
Affected packages
letta
- Ecosystem
- PyPI
- Affected
- <= 0.3.17
- Fixed in
- No patched version yet
- Check
pip show letta
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-39025
- https://github.com/letta-ai/letta/releases/tag/0.3.17
- https://medium.com/@cnetsec/a-vulnerability-cve-2024-39025-has-been-identified-in-lettaai-memgpt-v0-3-17-146cb38bb6db
- https://github.com/letta-ai/letta/blob/0.3.17/memgpt/server/rest_api/admin/users.py#L55-L68
- https://github.com/advisories/GHSA-7p2g-2vxc-5g55
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology