PT-2026-28690 · Git+2 · Letta

Eric-Z + 1 · CVE-2026-4964 · Published 2026-03-27 · Updated 2026-03-27

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions letta-ai letta version 0.16.4

Description A server-side request forgery (SSRF) exists in the File URL Handler component. This occurs when the ImageContent argument is manipulated within the convert message create to message() function located in the letta/helpers/message helper.py file, allowing for remote attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the ImageContent argument within the convert message create to message() function to minimize the risk of exploitation.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-4964

Affected Products

Letta

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4964.json · Exploit
• 🔥 https://vuldb.com/?submit.777645 · Exploit
• 🔥 https://gist.github.com/YLChen-007/fde4d5ed6ac4aa876f73f8954c6214da · Exploit
• https://osv.dev/vulnerability/CVE-2026-4964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4964 · Security Note
• https://vuldb.com/?id.353841 · Note
• https://vuldb.com/?ctiid.353841 · Note