All posts
Unproven Execution

MindsDB Anton Scratchpad: Unproven Execution by Default

CVE-2026-73678 turns MindsDB's Anton agent into an anonymous Python REPL: no auth on /api/v1/responses/, and the scratchpad tool runs exec() unsandboxed

Securityv0 Intelligence Team OWASP: ASI05 sv0 finding: unproven_execution
mindsdb anton unproven-execution prompt-injection cve-2026-73678 python-repl

The Incident

On August 14, 2026, CVE-2026-73678 was published against MindsDB’s Minds Platform (v26.1.0 and earlier) with a CVSS score of 10.0 for unauthenticated remote code execution through the platform’s embedded Anton agent. An attacker first calls the unauthenticated PUT /api/v1/settings/ route to plant their own LLM API key, then submits a crafted prompt to the unauthenticated POST /api/v1/responses/ route directing Anton to invoke its built-in “scratchpad” tool. That tool reaches exec(compiled, namespace) in scratchpad_boot.py on attacker-influenced Python source with no sandbox — the crafted prompt therefore becomes arbitrary OS command execution as the user running the Minds Platform process, with reach into SSH keys, stored credentials, and environment secrets.

The chain is self-contained: because the settings endpoint accepts an attacker’s LLM key without authentication, the exploit does not depend on the victim having already configured a working model provider. Coverage first appeared through NetFoundry’s weekly reachability tracker and TheHackerWire’s deep-dive on the CVE, with independent write-ups and PoC discussion surfacing on security forums.

MITRE ATT&CK: T1059.006 (Command and Scripting Interpreter: Python) covers the exec() sink; T1552 (Unsecured Credentials) covers the SSH-key and credential exfiltration payoff.

The Authority Path That Failed

The identity carrying execution authority at the moment of failure was the Anton agent process, running as whatever OS user launched Minds Platform. The scope Anton held was the union of two grants the operator likely never made consciously: a code-execution tool wired into its default toolset (the scratchpad’s exec() sink), and reachability from any anonymous caller through /api/v1/responses/. The scope the operator intended it to exercise was database Q&A on behalf of a logged-in end user, over an authenticated session.

The trust anchor that failed first is the implicit attachment of a Python exec() tool to the agent. An operator who deploys “AI over my database” is not consciously standing up a Python REPL; the framework did that for them. The second anchor is the POST /api/v1/responses/ route serving that agent without any identity check, which turns the framework default into a drive-by RCE from a browser. The gap between held and exercised authority could have been surfaced pre-incident by any inventory that answers “which agents in this deployment have a code-execution tool wired in, and what identity gates access to those agents?”

SecurityV0 Perspective

This is unproven_execution, the same class as the Langflow CSV Agent + Python REPL case: a framework attached a code-execution primitive to the agent by default, the deploying operator never explicitly authorized that primitive for external callers, and the resulting exec surface was reachable without a conscious grant. The prompt-injection surface only matters because the unproven exec tool exists on the agent — patching prompt-injection defenses without inventorying the exec surface leaves the drive-by RCE intact.

The control question is broader than one Anton instance: across the connected environment, which agent surfaces expose code execution, which identities can reach them, and where does configured authority exceed intended work? That view lets security teams prioritize anonymous paths to execution before they become public shells.

What To Do

  • Take every Minds Platform instance ≤ 26.1.0 off the public network today. The exploit needs no credentials, no session, and no social engineering; any reachable instance is exposed until MindsDB ships a fixed release. Restrict /api/v1/settings/ and /api/v1/responses/ at the reverse proxy or firewall to authenticated internal callers only.
  • Investigate exposed instances and rotate credentials when evidence warrants it. Review Minds Platform, reverse-proxy, and host activity across the exposure window. If execution or credential access cannot be ruled out, rotate the SSH keys, provider keys, database credentials, and environment secrets available to the process.
  • Find every exec()-class capability across the connected surface. Anton’s scratchpad is one; Langflow’s Python REPL was another. Identify agents and workflows that can reach code execution, compare that authority with approved work, and remove or constrain grants that have no business need.
  • Bind every agent endpoint to an authenticated identity before exposing it. For every route that dispatches a prompt to an agent that has a code-execution tool, require a caller identity the platform can attribute and rate-limit. A missing auth guard on such a route is not a configuration nit — it is a public shell.
  • Alert when unauthenticated traffic reaches an execution-capable surface. Correlate endpoint, identity, tool, and host telemetry so security teams can detect anonymous dispatch to Python or shell execution without requiring per-agent instrumentation.

Sources

All posts