MindsDB Minds Platform version 26.1.0 and earlier — CVE-2026-73678 (Critical)

Date Aug 14, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product MindsDB · Minds Platform version 26.1.0 and earlier

CVE CVE-2026-73678

Critical vendor advisory CVE-2026-73678

Summary

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python source without sandboxing. Attackers can first configure their own LLM API key through the unauthenticated PUT /api/v1/settings/ endpoint, then POST a prompt directing the agent to invoke the scratchpad tool with arbitrary Python code,

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 10.0) in MindsDB Minds Platform version 26.1.0 and earlier. Patch or mitigate promptly.

Operator check

Review CVE-2026-73678 in your asset inventory. Apply patches per vendor guidance and verify Minds Platform version 26.1.0 and earlier is not exposed. CVSS score: 10.0.

Sources

NVD — CVE-2026-73678 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed