CVE-2026-73678

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73678
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73678.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73678
Aliases
  • GHSA-jcxw-h8ph-pxpv
Published
2026-08-14T18:49:36.356Z
Modified
2026-08-16T03:48:45.919412639Z
Severity
  • 10.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()
Details

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python source without sandboxing. Attackers can first configure their own LLM API key through the unauthenticated PUT /api/v1/settings/ endpoint, then POST a prompt directing the agent to invoke the scratchpad tool with arbitrary Python code, achieving full OS command execution as the user running the desktop application and enabling access to SSH keys, stored credentials, and environment secrets.

Database specific 
{
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73678.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/mindsdb/mindshub

Affected ranges

Type
GIT
Repo
https://github.com/mindsdb/mindshub
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
86be14b66b169e040abe5bf5829b6a15d0644d6b
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "26.1.0"
        }
    ]
}

Affected versions

2.*
2.14.0
2.20.1
2.21.0
2.21.1
2.21.2
2.30.0
2.31.0
2.33.0
2.36.0
2.36.0v2
2.37.0
2.38.0
v0.*
v0.8.8
v0.8.9.1
v1.*
v1.0.6
v2.*
v2.0.0
v2.1.0
v2.1.1
v2.1.2
v2.10.0
v2.10.2
v2.11.0
v2.11.1
v2.11.2
v2.14.0
v2.15.0
v2.17.1
v2.2.0
v2.2.1
v2.26.0
v2.27.0
v2.3.0
v2.30.1
v2.35.0
v2.39.0
v2.4.0
v2.40.0
v2.41.0
v2.41.1
v2.41.2
v2.42.0
v2.42.1
v2.42.2
v2.43.0
v2.44.0
v2.45.0
v2.45.1
v2.45.2
v2.5.0
v2.6.0
v2.6.1
v2.7.0
v2.7.1
v2.7.2
v2.8.0
v2.8.1
v2.8.3
v2.9.0
v2.9.1
v22.*
v22.11.4.0
v22.11.4.1
v22.11.4.2
v22.11.4.3
v22.12.4.0
v22.5.1.2
v23.*
v23.11.28.1-alpha
v23.11.4.4a1
v24.*
v24.10.1.0
v24.10.2.0
v24.10.3.0
v24.10.4.0
v24.10.4.1
v24.10.4.2
v24.10.5.0
v24.11.1.0
v24.11.1.1
v24.11.2.0
v24.11.3.0
v24.11.4.0
v24.11.4.1
v24.11.4.2
v24.12.1.0
v24.12.2.0
v24.12.2.1
v24.12.3.0
v24.12.4.0
v24.5.4.0
v24.6.1.0
v24.6.1.1
v24.6.2.0
v24.6.2.2
v24.6.3.0
v24.6.3.1
v24.6.4.0
v24.6.4.1
v24.7.1.0
v24.7.2.0
v24.7.3.0
v24.7.4.0
v24.7.4.1
v24.7.5.0
v24.8.1.0
v24.8.1.1
v24.8.2.0
v24.8.3.0
v24.8.4.0
v24.9.1.0
v24.9.2.0
v24.9.2.1
v24.9.3.0
v24.9.3.1
v24.9.3.2
v24.9.4.0
v24.9.4.1
v25.*
v25.1.2.0
v25.1.2.1
v25.1.3.0
v25.1.4.0
v25.1.5.0
v25.1.5.1
v25.1.5.2
v25.1.5.3
v25.10.0
v25.10.1
v25.11.1
v25.12.0
v25.13.0
v25.13.1
v25.14.0
v25.14.1
v25.2.1.0
v25.2.1.1
v25.2.1.2
v25.2.2.0
v25.2.2.1
v25.2.2.2
v25.2.3.0
v25.2.4.0
v25.3.1.0
v25.3.2.0
v25.3.3.0
v25.3.4.0
v25.3.4.1
v25.3.4.2
v25.4.1.0
v25.4.2.0
v25.4.2.1
v25.4.3.0
v25.4.3.1
v25.4.4.0
v25.4.5.0
v25.5.3.0
v25.5.4.0
v25.5.4.1
v25.5.4.2
v25.6.2.0
v25.6.3.0
v25.6.3.1
v25.6.4.0
v25.7.1.0
v25.7.2.0
v25.7.3.0
v25.7.4.0
v25.8.2.0
v25.8.3.0
v25.9.1.0
v25.9.1.1
v25.9.1.2
v26.*
v26.0.0
v26.0.1
v26.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73678.json"