---
id: CVE-2026-73678
title: >-
  MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated
  remote code execution vulnerability that allows unauthenticated attackers to
  execute arbitrary OS commands by submitting crafted prompts to the unprotected
  POS…
summary: >-
  MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated
  remote code execution vulnerability that allows unauthenticated attackers to
  execute arbitrary OS commands by submitting crafted prompts to the unprotected
  POS…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: MindsDB
product: Minds Platform
affected:
  - minds_platform <= 26.1.0
published: '2026-08-14'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73678'
references:
  - url: 'https://github.com/mindsdb/minds-platform'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/mindsdb/minds-platform/security/advisories/GHSA-jcxw-h8ph-pxpv
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/mindsdb-minds-platform-unauthenticated-rce-via-scratchpad-exec
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/mindsdb/mindshub/security/advisories/GHSA-jcxw-h8ph-pxpv
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.01588
epssPercentile: 0.74536
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/Boreas37/CVE-2026-73678-PoC'
    - >-
      https://github.com/Hunt-Benito/bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdb-cowork
  checkedAt: '2026-09-24T20:52:15.407Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-17T18:08:06.122321Z'
ingestedAt: '2026-09-24T15:45:56.709Z'
---

## Overview

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python source without sandboxing. Attackers can first configure their own LLM API key through the unauthenticated PUT /api/v1/settings/ endpoint, then POST a prompt directing the agent to invoke the scratchpad tool with arbitrary Python code, achieving full OS command execution as the user running the desktop application and enabling access to SSH keys, stored credentials, and environment secrets.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.