MindsDB exposes unauthenticated remote code execution through its AI agent
CVE-2026-73678, scored CVSS 10, lets an attacker with no account run system commands on the MindsDB platform through the Anton agent’s scratchpad tool. If you expose a MindsDB instance, cut public access before even waiting for a patch.
August 14, 2026. The NVD registers CVE-2026-73678 with a CVSS score of 10 — the maximum. The target is not a firewall or a VPN: it is MindsDB, an AI platform that wires language models to your databases. The vector: the scratchpad tool of its Anton agent, which calls exec() on attacker-influenced Python, without a sandbox.
The scenario is as simple as it is alarming. An attacker with no account at all sends a crafted request to POST /api/v1/responses/, reaches the agent’s execution tool, and gains arbitrary system commands under the identity of the process running the platform. Everything the instance held in memory — SSH keys, stored credentials, environment secrets — is within reach, plus a path to pivot into the rest of the network.
A CVSS 10, with all three exploitability dials at zero
The severity lives in the vector, which stacks the three worst characteristics. Network: the attack arrives over the internet, no physical proximity. No privileges: no authentication needed. No interaction: no human has to click anything. It is the “Network · No privileges · No interaction” triple that security teams dread — fully automatable, scannable at scale.
The exploit chain is a two-step failure. The attacker first sets their own LLM API key through an unprotected settings endpoint (PUT /api/v1/settings/). Then they invoke the scratchpad tool of the Anton agent, which executes Python whose source is attacker-influenced, with no sandbox boundary anywhere. The result is full remote code execution, described by the NVD as allowing “arbitrary OS command execution” and access to “sensitive environment credentials.”
MindsDB is the kind of tool data teams deploy fast, often self-hosted, to expose natural-language queries over internal databases. Its value comes precisely from being connected to everything: databases, warehouses, model API keys. That same connectivity is what turns an RCE into a major incident — the compromised instance becomes a pivot point into the data it was meant to serve.
The two-step chain also means the flaw is not exotic. An attacker does not need a zero-day in the model runtime or a browser exploit: they need only to reach an unauthenticated endpoint and ask the agent to run code. That is a two-line script, not a research project — which is why the window between disclosure and wide scanning is measured in hours, not weeks.
AI agents widen the attack surface, not just the AI
What makes CVE-2026-73678 instructive beyond MindsDB is the pattern. The scratchpad — a space where the agent writes and runs code to reason — is an execution primitive now standard in agent frameworks. Every platform that adds a code-execution “tool” adds, mechanically, a potential RCE to its surface. And we deploy these platforms with the discipline of an internal database — sometimes less.
The risk breaks into three layers. First, exposure: an unauthenticated API endpoint is the front door. Second, tooling: an agent that can exec() turns any poorly-controlled input into a system command. Third, sandboxing: the absence of isolation between the agent’s code and the host is what separates contained execution from total compromise. On MindsDB, all three layers fell at once — hence the 10.
The contrast with a classic SQL injection is worth spelling out. A SQL injection often demands understanding the target schema and bypassing filters; here, the attacker needs to understand nothing about the target’s business. The execution tool does the work for them: it turns input directly into a command. That is an exploitation shortcut that lowers the technical bar and mechanically widens the pool of attackers.
The parallel with prompt injection is direct. An agent that executes code from untrusted input is vulnerable by construction, even without a sophisticated “injection”: the input only has to reach the execution tool. The lesson applies to every data-connected agent product: the execution tool must be optional, disableable and isolated — never on by default on a public endpoint.
Who is affected, and how to tell
MindsDB targets the data and AI teams who want to query their databases in natural language. It is typically deployed self-hosted — a Docker image or pip install — on a machine that has access to internal databases, warehouses and model API keys. That position, at the center of the information system, is exactly what makes CVE-2026-73678 a high-impact incident despite a niche product.
The perimeter question is easy to ask: any instance on version 26.1.0 or earlier is vulnerable, and exploitation needs no account. Checking your version and whether the POST /api/v1/responses/ endpoint is reachable is enough to establish exposure. An instance behind a VPN or an IP allowlist is not reachable from outside; an exposed one is.
The signal goes beyond MindsDB. The pattern — a code-execution tool reachable without authentication — will recur in other agent platforms. The structural fix does not change: an agent’s execution tool must live in a dedicated container, with no network access to internal systems by default, and never behind a public endpoint. An agent that reasons does not need a shell on the host.
What to do while no patch is confirmed
As of August 15, 2026, the availability of a vendor fix was not confirmed in the aggregators, and no public exploit was documented — but the absence of a public exploit is no protection, especially for a flaw exploitable with no authentication. The response is three moves, in order.
Isolate first. Restrict access to the platform’s endpoints with a firewall or a VPN. If the instance has no reason to be reachable from the internet, pull it out of public exposure now — it is the highest-value move, and it is reversible once the patch lands.
Then monitor. The two endpoints involved leave clean traces in the web front logs:
# Look for calls to the RCE endpoint and the LLM configuration endpoint
grep -E "POST /api/v1/responses/|PUT /api/v1/settings/" /var/log/nginx/access.logA PUT /api/v1/settings/ closely followed by a POST /api/v1/responses/ from the same address is the exact pattern of the documented exploit.
Finally, harden. Until a patch exists, a properly tuned WAF can block requests carrying suspicious Python syntax to the responses endpoint. It is a partial net — variants get through — but it complements network isolation rather than replacing it. Disable the Anton agent and its execution tool if your use of MindsDB does not require them.
Verdict
If you expose a MindsDB instance to the internet, treat it as compromised until proven otherwise: cut public exposure, inspect logs for anomalous PUT /api/v1/settings/ calls, and prepare to rotate every secret the instance could read — database keys, model API keys, environment credentials.
If you adopt data-connected agent platforms, add one rule to your process: an agent’s code-execution tool is a critical privilege, not a casual feature. It must be off by default, isolated in a sandbox when active, and never exposed on an unauthenticated endpoint.
The bigger signal is unambiguous: AI agents do not move risk into “AI,” they move it into execution. Every tool that turns input into a command is a new door — and the teams deploying them like internal bricks, with no exposure review, are the ones a CVSS 10 like this hits first.