CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-73678 — MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated re...

·Source: NIST NVD

Updated:

Executive Summary

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python source without sandboxing. Attackers

Analysis

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python source without sandboxing. Attackers can first configure their own LLM API key through the unauthenticated PUT /api/v1/settings/ endpoint, then POST a prompt directing the agent to invoke the scratchpad tool with arbitrary Python code, achieving full OS command execution as the user running the desktop application and enabling access to SSH keys, stored credentials, and environment secrets. CVSS Score: 10. Published: 2026-08-14T19:18:01.457.

Indicators of Compromise (1)

CVE (1)
CVE-2026-73678
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 14, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Financial data startup Quatr raises $18 million

Quartr, the world's leading first-party data layer for institutional finance and AI, today announced it has closed a $18 million funding round, led by existing investor Altos Ventures with participation from new investor SEB (publ.)

Finextra
LOWVulnerabilityNEW

300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw

Tracked as CVE-2026-15748, the arbitrary file upload bug allows unauthenticated attackers to upload executable files. The post 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw appeared first on SecurityWeek .

CVE-2026-15748
SecurityWeek
LOWVulnerability

Confluence adds AI-enabled automation to its product suite.

Confluence Technologies, Inc. (“Confluence”), a global leader in regulatory, analytics, and investor communications solutions for the investment management industry, today announced the launch of Confluence POINT, AI-enabled automation that optimizes workflows across its solutions.

Finextra