Summary
CVE-2026-73678 is a critical, unauthenticated remote code execution (RCE) vulnerability affecting the MindsDB Minds Platform, versions 26.1.0 and earlier. The flaw stems from an unprotected API endpoint that allows attacker-controlled prompts to reach an AI agent’s code-execution tool, which runs Python code via exec() without any sandboxing. The vulnerability carries the maximum CVSS v3.1 score of 10.0 and enables full, unauthenticated compromise of the host system.
Technical details
- Root cause: The Minds Platform’s FastAPI backend exposes the
POST /api/v1/responses/endpoint with no authentication check, allowing any network-reachable client to submit prompts directly to the platform’s built-in "Anton" AI agent. - Unsafe code execution: The Anton agent’s "scratchpad" tool executes LLM-generated Python source code via
exec(compiled, namespace)with no restrictions on the operations performed, allowing arbitrary OS command execution through subprocess calls embedded in the generated code. - Compounding weaknesses: The API also ships with an overly permissive CORS configuration (
allow_origins=["*"]combined withallow_credentials=True), which can enable exploitation from a malicious webpage visited by a user with the application running locally, and an unauthenticatedPUT /api/v1/settings/endpoint that lets an attacker configure their own LLM API key to drive the agent without needing any victim credentials. - Attack vector: Network (no authentication or user interaction required). An attacker sends a crafted HTTP request to the settings endpoint to register an attacker-controlled LLM key, then submits a malicious prompt to the responses endpoint to trigger code execution via the scratchpad tool.
- Impact: Complete compromise of confidentiality, integrity, and availability — arbitrary OS command execution with the privileges of the desktop/server application process, enabling credential theft, data destruction, persistence, and lateral movement.
- Relevant weaknesses: CWE-94 (Code Injection), CWE-306 (Missing Authentication for Critical Function), CWE-942 (Permissive Cross-domain Policy with Untrusted Domains).
Affected software
- MindsDB Minds Platform, all versions up to and including 26.1.0
Severity
- CVSS v3.1 Base Score: 10.0 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS v4.0 Score: 10.0 (Critical) —
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Mitigation and recommended actions
- Immediate: No patched version has been published at the time of disclosure. Organizations running MindsDB Minds Platform (26.1.0 or earlier) should monitor the vendor’s GitHub security advisory and repository for a fixed release and apply it as soon as it becomes available.
- Network mitigations (until a patch is released):
- Restrict network access to the Minds Platform API (including its default port) to trusted hosts only; do not expose it directly to the internet.
- Place the service behind an authenticating reverse proxy or API gateway that enforces access control on
/api/v1/responses/and/api/v1/settings/. - Disable or firewall the
/api/v1/settings/endpoint to prevent unauthorized configuration of LLM provider keys. - Review and tighten the application’s CORS policy — avoid combining
allow_origins=["*"]withallow_credentials=True. - Monitor for unexpected outbound connections, unauthorized subprocess execution, or unusual API activity on hosts running the platform.
- Where feasible, run the platform in an isolated/sandboxed environment (container with minimal privileges) to limit the blast radius of any code execution.