CVE-2026-77936: Letta AI Agent Server Ships Unauthenticated API and Exposed PostgreSQL — Detection and Remediation Guide

COPY tbl FROM PROGRAM '<os command>'

---
title: PostgreSQL COPY FROM PROGRAM Command Execution
description: Detects PostgreSQL superuser abuse of COPY FROM PROGRAM to execute operating system commands, as seen in exploitation of CVE-2026-77936 against exposed Letta deployments. Source can be PostgreSQL server logs ingested via Sysmon, auditd, or file-based log collection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77936
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
id: 8c2f4a71-3b5e-4d9a-b6c1-7e2f8a4d5c90
status: experimental
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: linux
  service: postgresql
detection:
  selection:
    - 'COPY '
    - 'PROGRAM'
  condition: selection
falsepositives:
  - Rare legitimate ETL or administrative use of COPY FROM PROGRAM by DBAs; baseline approved usage and alert on all deviations
level: high
---
title: Shell or Interpreter Spawned by PostgreSQL Server Process
description: Detects the PostgreSQL backend process spawning shells or scripting interpreters, a strong post-exploitation indicator of COPY FROM PROGRAM abuse in CVE-2026-77936.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77936
  - https://attack.mitre.org/techniques/T1059.006/
author: Security Arsenal
id: 3d7b9e52-1c4a-4f8b-a2d6-9e1c5b7a3f08
status: experimental
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/postgres'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate PostgreSQL extensions or maintenance scripts; uncommon in most environments
level: critical
---
title: Outbound Network Connection from PostgreSQL or Letta Server Process
description: Detects unexpected outbound network connections from postgres or letta server processes, consistent with reverse shells or data exfiltration following CVE-2026-77936 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77936
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
id: 5a1e6c84-7d2b-4f3c-98a1-2b4d6e8f0c17
status: experimental
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/postgres'
      - '/letta'
      - '/uvicorn'
  filter_loopback:
    DestinationIp|startswith:
      - '127.'
      - '::1'
  filter_internal_pg:
    DestinationPort: 5432
  condition: selection_proc and not filter_loopback and not filter_internal_pg
falsepositives:
  - Letta legitimately calls LLM provider APIs (api.openai.com, api.anthropic.com); tune with a destination allowlist for known model endpoints
level: medium

// Hunt 1: PostgreSQL COPY FROM PROGRAM abuse via Syslog ingestion
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any ("postgres", "postmaster")
| where SyslogMessage has_all ("COPY", "PROGRAM")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;

// Hunt 2: Shell/interpreter spawned by postgres or letta process (MDE)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("postgres", "letta", "uvicorn")
| where FileName has_any ("sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "socat")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

// Hunt 3: Unauthenticated requests to sensitive Letta API routes (via W3C/CEF web or container logs in CommonSecurityLog)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/v1/tools/run", "/v1/admin")
| where RequestMethod == "POST"
| extend IsSensitiveToolRun = RequestURL has "/v1/tools/run"
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestMethod, RequestURL, IsSensitiveToolRun
| order by TimeGenerated desc;

// Hunt 4: Exposed PostgreSQL — inbound connections to 5432 from non-RFC1918 sources
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort == 5432
| where not(ipv4_is_private(SourceIP))
| summarize ConnectionCount = count(), Sources = make_set(SourceIP) by DestinationIP, DestinationPort
| order by ConnectionCount desc;

-- CVE-2026-77936: Hunt for exposed/exploited Letta + PostgreSQL deployments
-- Collects suspicious process trees, listening ports, and log evidence.

LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)postgres|letta|uvicorn';

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)^(sh|bash|dash|python3?|perl|curl|wget|nc|ncat|socat)$'
  AND Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)postgres|letta|uvicorn');

LET listeners = SELECT Pid, Name, Family, Address, Port, Status
FROM netstat()
WHERE Port IN (5432, 8283) AND Status = 'LISTEN';

LET log_hits = SELECT FullPath, Line
FROM foreach(
  row={
    SELECT FullPath FROM glob(globs='/var/log/postgresql/*.log')
  },
  query={
    SELECT FullPath, parse_file_with_regex(
      filename=FullPath,
      regex='(?im)^.*COPY.*PROGRAM.*$') AS Line
    FROM scope()
  });

SELECT * FROM procs
UNION ALL
SELECT * FROM suspicious_children;

SELECT * FROM listeners;
SELECT * FROM log_hits;

#!/usr/bin/env bash
# CVE-2026-77936 - Letta deployment verification & hardening
set -euo pipefail

REPORT="/tmp/letta_cve_2026_77936_$(date +%Y%m%d_%H%M%S).txt"
echo "=== CVE-2026-77936 Letta Assessment $(date) ===" | tee "$REPORT"

# 1. Locate Letta compose files and check for LETTA_SERVER_SECURE
echo "--- [1] Scanning for Letta compose files ---" | tee -a "$REPORT"
find / -maxdepth 6 \( -name 'compose.yaml' -o -name 'docker-compose.yml' -o -name 'docker-compose.yaml' \) 2>/dev/null | while read -r f; do
  if grep -qi 'letta' "$f" 2>/dev/null; then
    echo "FOUND: $f" | tee -a "$REPORT"
    if grep -q 'LETTA_SERVER_SECURE' "$f"; then
      echo "  [OK] LETTA_SERVER_SECURE present" | tee -a "$REPORT"
    else
      echo "  [VULNERABLE] LETTA_SERVER_SECURE missing -> API is unauthenticated" | tee -a "$REPORT"
    fi
    grep -i 'PGPASSWORD\|POSTGRES_PASSWORD\|5432' "$f" | tee -a "$REPORT" || true
  fi
done

# 2. Check running containers
echo "--- [2] Running Letta/Postgres containers ---" | tee -a "$REPORT"
if command -v docker >/dev/null 2>&1; then
  docker ps --format '{{.Names}}\t{{.Image}}\t{{.Ports}}' | grep -Ei 'letta|postgres' | tee -a "$REPORT" || echo "  none found" | tee -a "$REPORT"
  # Check env of running letta containers
  docker ps --format '{{.Names}}' | grep -i letta | while read -r c; do
    echo "  Container: $c" | tee -a "$REPORT"
    docker inspect "$c" --format '{{range .Config.Env}}{{println .}}{{end}}' | grep -E 'LETTA_SERVER_SECURE|LETTA_SERVER_PASSWORD|PGPASSWORD' | sed 's/=.*PASSWORD.*/=<redacted-present>/' | tee -a "$REPORT" || true
  done
fi

# 3. Check for network exposure of sensitive ports
echo "--- [3] Listening sockets (5432 / 8283) ---" | tee -a "$REPORT"
ss -tlnp 2>/dev/null | grep -E ':(5432|8283)\b' | tee -a "$REPORT" || echo "  not listening locally" | tee -a "$REPORT"

# 4. Triage: evidence of COPY FROM PROGRAM abuse
echo "--- [4] PostgreSQL log check for COPY ... PROGRAM ---" | tee -a "$REPORT"
grep -rniE 'COPY .* PROGRAM' /var/log/postgresql/ 2>/dev/null | tee -a "$REPORT" || echo "  no evidence in local postgres logs" | tee -a "$REPORT"

# 5. Triage: suspicious children of postgres/letta
echo "--- [5] Suspicious child processes ---" | tee -a "$REPORT"
for pid in $(pgrep -f 'postgres|letta|uvicorn' 2>/dev/null); do
  ps --ppid "$pid" -o pid,ppid,comm,args 2>/dev/null | grep -E 'sh|bash|python|curl|wget|nc' | tee -a "$REPORT" || true
done

# 6. HARDENING: generate a hardened override compose file
echo "--- [6] Writing hardened override to ./compose.hardened.yaml ---" | tee -a "$REPORT"
PG_PASS="$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9' | head -c 32)"
SRV_PASS="$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9' | head -c 32)"
cat > ./compose.hardened.yaml <<EOF
# CVE-2026-77936 hardening override - review service/db names against your stack
services:
  letta:
    environment:
      LETTA_SERVER_SECURE: "true"
      LETTA_SERVER_PASSWORD: "${SRV_PASS}"
      PGPASSWORD: "${PG_PASS}"
  db:
    environment:
      POSTGRES_PASSWORD: "${PG_PASS}"
    ports: []   # remove host port publish; keep DB on internal docker network only
EOF
echo "  Override written. Deploy with: docker compose -f compose.yaml -f compose.hardened.yaml up -d" | tee -a "$REPORT"
echo "  Rotate ALL secrets previously in env (LLM API keys) - assume compromise." | tee -a "$REPORT"

echo "=== Assessment complete: $REPORT ==="