Description

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python source without sandboxing. Attackers can first configure their own LLM API key through the unauthenticated PUT /api/v1/settings/ endpoint, then POST a prompt directing the agent to invoke the scratchpad tool with arbitrary Python code, achieving full OS command execution as the user running the desktop application and enabling access to SSH keys, stored credentials, and environment secrets.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-14T19:18:01.457Z",
  "pubdate": "2026-08-14T19:18:01.457Z",
  "executiveSummary": "MindsDB Minds Platform version 26.1.0 and earlier suffers from an unauthenticated remote code execution vulnerability residing in the Anton agent's scratchpad tool. This critical security flaw allows unauthenticated remote attackers to execute arbitrary operating system commands by submitting specially crafted prompts to an unprotected application endpoint. The vulnerability exposes systems to full system compromise, as attackers can leverage the flaw to execute arbitrary Python code without any prior authentication or privileges.\nThe risk implications are severe, granting malicious actors the ability to abuse system execution capabilities directly through the desktop application context. Attackers can access sensitive local resources, including SSH keys, stored credentials, and environment secrets. Successful exploitation requires no pre-existing user accounts or authentication tokens, making it a high-severity entry point for network-adjacent or remote attackers capable of interacting with the vulnerable HTTP API endpoints exposed by the desktop application.",
  "technicalDetails": "The vulnerability exists within the MindsDB Minds Platform version 26.1.0 and earlier due to insecure API design and a lack of input sanitization or sandboxing within the Anton agent's scratchpad tool. Specifically, the application exposes unauthenticated HTTP endpoints, namely PUT /api/v1/settings/ and POST /api/v1/responses/, which fail to enforce access controls or session validation.\nThe exploitation flow proceeds in a sequential manner. First, an unauthenticated attacker leverages the unprotected PUT /api/v1/settings/ endpoint to configure a custom Large Language Model (LLM) API key, establishing the necessary backend integration for subsequent prompt processing. Second, the attacker sends a malicious payload via a POST request to the unprotected /api/v1/responses/ endpoint. This payload contains a crafted prompt designed to manipulate the Anton agent.\nThe prompt directs the agent to invoke its scratchpad tool, which internally executes Python's exec() function on attacker-influenced Python source code without implementing any sandboxing mechanisms or safety boundaries. Because the scratchpad tool processes the untrusted input directly via exec(), the injected Python instructions are executed immediately within the context of the user running the desktop application.\nThis execution flow grants the attacker full operating system command execution capabilities. The post-exploitation impact includes unauthorized access to highly sensitive system assets, such as SSH keys, persistent application credentials, and sensitive environment variables stored within the execution environment of the host operating system."
}