Executive brief
MindsDB Minds Platform is a desktop application that provides AI-powered data analysis and workflow automation. An unauthenticated remote code execution vulnerability allows attackers to execute arbitrary operating system commands by submitting crafted prompts to an unprotected API endpoint. This enables attackers to steal SSH keys, stored credentials, and environment secrets with full system privileges, even without knowing the victim's credentials.
Technical details
The vulnerability is a remote code execution flaw in the Anton agent's scratchpad tool within the cowork-server FastAPI backend. The root causes are: (1) no authentication middleware protecting the entire /api/v1/ API router, (2) CORS wildcard configuration allowing cross-origin browser requests, and (3) unrestricted exec() call on LLM-generated Python code without sandboxing. An attacker can inject their own LLM API key via the unauthenticated PUT /api/v1/settings/ endpoint, then POST a crafted prompt to /api/v1/responses/ (also unauthenticated) that directs the Anton agent to invoke the scratchpad tool with arbitrary Python code. The compiled code is executed with exec() inside the server process namespace, achieving full OS command execution as the user running the application. No patch is currently available for versions 26.1.0 and earlier.
Affected products
- MindsDB Minds Platform 26.1.0 and earlier
Timeline
- 2026-07-17: disclosed: GitHub Security Advisory GHSA-jcxw-h8ph-pxpv published
- 2026-08-14: advisory: CVE-2026-73678 published on NVD