{"schema":"voidly-atlas-federal-record/v1","dataset":"nvd-cves","agency":"NIST","source":"NIST National Vulnerability Database","provider":"Voidly","license":"Source data is U.S. federal public domain (17 U.S.C. §105). Re-surfaced by Voidly under CC BY 4.0.","disclaimer":"This is the agency's own public-domain data, curated and made citable by Voidly. Voidly adds no independent claim — always verify against the linked canonical source.","generated_at":"2026-10-20T15:14:05.058Z","record":{"id":"CVE-2026-77938","cve_id":"CVE-2026-77938","published":"2026-10-20T01:17:20.410","last_modified":"2026-10-20T01:17:20.410","status":"Received","description":"Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTA_PG_URI, POSTGRES_PASSWORD, and provider API keys, then access cross-tenant database data.","cvss_score":6.5,"cvss_severity":"MEDIUM","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":"CWE-526","cpe_count":0,"source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77938","voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77938"},"citation":{"voidly_url":"https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77938","source_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77938","recommended":"CVE-2026-77938 — MEDIUM. NIST, via Voidly Atlas — Surveillance & Digital-Rights Watch. Retrieved 2026-10-20, https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77938","ris":"TY  - DATA\nTI  - CVE-2026-77938 — MEDIUM\nAU  - Voidly\nT2  - Voidly Atlas — Surveillance & Digital-Rights Watch\nPB  - Voidly\nPY  - 2026\nUR  - https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77938\nN1  - Source: NIST National Vulnerability Database, https://nvd.nist.gov/vuln/detail/CVE-2026-77938. Public domain (17 U.S.C. §105); re-surfaced under CC BY 4.0\nER  - ","apa":"Voidly. (2026). CVE-2026-77938 — MEDIUM [NIST National Vulnerability Database]. Voidly Atlas. Retrieved 2026-10-20, from https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77938","bibtex":"@misc{voidly_nvd_cves_CVE202677938,\n  title        = {CVE-2026-77938 — MEDIUM},\n  author       = {{Voidly}},\n  howpublished = {\\url{https://voidly.ai/atlas/federal/nvd-cves/CVE-2026-77938}},\n  note         = {Source: NIST National Vulnerability Database, https://nvd.nist.gov/vuln/detail/CVE-2026-77938. Public domain (17 U.S.C. §105); re-surfaced under CC BY 4.0},\n  urldate      = {2026-10-20},\n  year         = {2026}\n}"}}