External risk intelligence

MindsDB Minds Platform Unauthenticated Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-73678

The vulnerability exists in an API endpoint (/api/v1/responses/) of a platform designed to process prompts and interact with agents. While it is a desktop application, such platforms are frequently deployed in environments where their API services are exposed to network traffic or external integrations to facilitate agentic workflows.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the MindsDB Minds Platform that allows unauthenticated attackers to execute arbitrary operating system commands remotely. The flaw arises from improper handling of user-submitted prompts within an agent's tool, enabling attackers to bypass security measures and gain control of the system. This could potentially expose sensitive information such as credentials and secrets.

Unauthenticated remote code execution risk.
Critical for platforms processing user prompts.
Assess relevance and exposure immediately.

Attack Path

How an attacker could exploit the issue

An attacker can remotely execute arbitrary operating system commands by first establishing their own API key through an unprotected endpoint, then submitting a crafted prompt. This prompt directs the agent to use a vulnerable tool that executes attacker-controlled Python code without any safeguards, ultimately leading to full command execution on the system running the application.

Unauthenticated access to API endpoints required.
Prompt triggers agent to execute un-sandboxed Python code.
Compromise of sensitive credentials and data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary operating system commands on the system running the MindsDB Minds Platform application. This is possible by chaining two unauthenticated API requests: first, configuring an LLM API key, and then submitting a crafted prompt that directs the agent to execute malicious Python code through the scratchpad tool. When successful, this could lead to the compromise of sensitive information.

System data and credentials at risk.
Exploitable via crafted API requests.
Full OS command execution possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MindsDB platform's application owners and infrastructure teams are likely responsible for addressing this critical remote code execution vulnerability. The first practical step is to identify all instances of the affected technology, determine their network exposure and business criticality, and confirm the accountable owner for each. Once identified, a risk-based remediation plan can be developed, which may involve vendor coordination or other mitigation strategies.

Application owners should manage remediation.
Verify network exposure and business criticality.
Plan coordinated remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MindsDB Minds Platform?

MindsDB Minds Platform is a tool that allows users to create and manage intelligent agents capable of processing prompts and interacting with large language models. It provides a platform for agentic workflows, often used to automate tasks or integrate AI capabilities into applications. Because it manages agent logic and data, it typically requires access to various system resources and external API services to function.

What does CVE-2026-73678 mean by CWE-94?

CWE-94 refers to improper control of generation of code, often called code injection. In this vulnerability, the platform lacks a sandbox when processing certain commands. Because the software executes code provided in a prompt without verifying or restricting it, an attacker can supply their own Python instructions. The application then runs this code directly, effectively allowing the attacker to take over the operating system environment where the platform is running.

How is this vulnerability triggered?

An attacker triggers this by chaining two unauthenticated API requests. First, they configure an LLM API key through a public settings endpoint. Next, they send a prompt to the responses endpoint that instructs the agent to use its scratchpad tool. The attack only succeeds if the platform is configured to allow these API interactions; simply having the software installed without enabling its network-accessible API services would not facilitate this specific attack path.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that while MindsDB Minds Platform is a desktop application, its API endpoints are often exposed to facilitate integrations or network-based agent workflows. If your instance is reachable over a network, the risk is higher. You should assess whether your specific deployment exposes these API services to local network traffic or the internet, as this exposure significantly increases the feasibility of an attacker reaching the vulnerable endpoints.

What are the first steps to address this CVE?

Your priority is to identify every instance of the MindsDB Minds Platform within your environment. Verify who owns these applications and determine if they are exposed to network traffic. Since the platform executes arbitrary code, assume any affected system could be compromised and move to restrict access to the application's API endpoints immediately while you coordinate with your team to review official guidance or vendor-provided updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.