MindsDB CVE-2026-73678: an AI agent exposes unauthenticated RCE

CVE-2026-73678, a critical vulnerability in MindsDB Minds Platform, was published on 14 August 2026. Releases through 26.1.0 expose the cowork-server backend without authentication. A client can first set its own LLM provider key through the settings API, then submit a prompt to /api/v1/responses/. The Anton agent can pass generated source to a scratchpad tool that compiles it and calls Python exec() inside the server process. The result is operating-system command execution with the rights of the account running the application.

The project advisory scores it 10.0 under CVSS 3.1. No victim credential or explicit interaction is required. Permissive CORS may also let a website visited by a user send requests to local port 26866. A localhost-bound service is therefore not automatically safe: the browser can become a bridge between an external page and the local API.

Three defects form one chain

The first cause is missing authentication across /api/v1/. The responses route has no identity guard, and model settings are anonymous as well. An attacker does not need a victim’s provider key; they can supply their own key, choose a supported model and activate the agent flow.

The second cause is a CORS policy accepting every origin. CORS never protects an API from a direct network client, but here it also creates a path from an external webpage to an application on the user’s computer. If a browser can make cross-origin requests to localhost, “the port is not public” no longer defines an effective boundary.

The third and most important cause is the scratchpad. It accepts Python generated by the model, compiles it and invokes exec(compiled, namespace). This is not an isolated interpreter with a limited capability set. Code can import modules, read files, launch processes and connect to the network according to the MindsDB process rights.

Each issue matters independently, but their combination produces an anonymous client → prompt → agent → code execution path. Authentication would reduce reachability, strict CORS would contain the browser route, and a real sandbox would stop model output crossing into the operating system. Secure agents need every layer, not one system instruction.

This is more than prompt injection

The prompt steers the model, but the critical architectural failure is giving that model a general code-execution tool without independent policy. Phrase filters cannot provide assurance: semantically equivalent code has many forms, instructions can be encoded and model behaviour changes across providers and releases.

A high-risk tool should expose a narrow declarative operation set. If computation is required, the server can offer selected mathematical functions or a disposable sandbox without secrets and egress. General exec() in the main server process is equivalent to giving the model a shell with application rights.

Typed output does not solve authorization. A schema may prove that a field is a code string, but cannot decide whether that code is allowed to read an SSH key. Policy needs to address effects and resources rather than JSON validity.

Who is exposed

Minds Platform through 26.1.0 is directly affected. The advisory lists no patched version. Highest priority goes to network-reachable instances, development environments forwarding a port through Docker or an IDE, desktops with the local port active, and servers running under accounts holding repository, cloud or AI-provider credentials.

Inventory must include non-production use. A developer process may see the .ssh directory, Git configuration, provider keys, .env files and internal network services. RCE on a workstation can have a larger blast radius than compromise of a strongly isolated pod.

Review bind addresses, Docker publishing, tunnels, reverse proxies, Codespaces and browser reachability. Localhost reduces direct network access but does not remove the drive-by route described by the advisory.

Responding when no patched release exists

1. Stop Minds Platform until a verified fix is available where the scratchpad is not essential.
2. Block port 26866 outside one administration host and prevent browser access with host firewall or an authenticated proxy.
3. Disable or remove the scratchpad and every route to exec(); a changed prompt is not sufficient.
4. Run the service as a dedicated unprivileged user in an ephemeral container with a read-only root, no home directory and no secrets.
5. Apply default-deny egress, allowing only the necessary model endpoint through a controlled proxy.
6. Monitor project releases. Accept a fix only after confirming authentication, CORS and unrestricted execution are addressed.
7. If the service ran while vulnerable, investigate the host before rotating credentials so evidence is preserved and persistence is removed.

A reverse proxy can be a temporary mitigation only when it protects localhost and every interface. If the unauthenticated backend remains reachable directly, bypassing the proxy restores the flaw. Network namespace and host rules should prevent that route.

Looking for exploitation

Review requests to /api/v1/settings/ and /api/v1/responses/, especially those without expected user context, from unfamiliar origins or at unusual times. Look for provider changes, new keys and a sudden increase in scratchpad activity. Where application logs lack context, correlate HTTP records with process telemetry.

At host level, find child processes of the Python server, new temporary files, .bashrc, cron or authorized_keys changes, network utilities and connections to novel destinations. File reads may leave little evidence, so rotation scope should follow the process’s effective access and exposure window.

After confirmed RCE, stopping or updating the application does not close the incident. Rebuild the host from a trusted source or reach equivalent assurance, rotate secrets only after removing persistence, and inspect accounts and systems reachable from the machine.

A safer pattern for code-running agents

When model-generated code is genuinely required, execute it in a disposable sandbox without secrets, network, a rich filesystem or access to the parent host. Set time, memory and process limits. The output should be plain data. The sandbox must not share a Docker socket, ServiceAccount token or server home directory.

A policy layer should evaluate the plan first: approved language, libraries, size, I/O and business purpose. Irreversible actions require approval bound to the exact code artifact. Store logs outside the worker so executed code cannot alter them.

The endpoint, CORS, scratchpad, version range and absence of a patch are facts from the project advisory and CVE record. The sources do not establish a mass campaign. Segmentation, hunting and sandbox design are Breachroad recommendations. This is an excellent case for AI and cybersecurity training, while agent architecture and permissions can be formalised through a secure AI implementation review.