Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python source without sandboxing. Attackers can first configure their own LLM API key through the unauthenticated PUT /api/v1/settings/ endpoint, then POST a prompt directing the agent to invoke the scratchpad tool with arbitrary Python code, achieving full OS command execution as the user running the desktop application and enabling access to SSH keys, stored credentials, and environment secrets.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-15 | 3 | Disclosure3 |
| 2026-08-17 | 3 | Disclosure2Exploit1 |
[EXPLOIT] EGE-GH-UkSJfvx [CRITICAL/PoC] Linked: CVE-2026-73678 CVE-2026-73678-PoC 🔗 https://exploitgrid.net/exploits/2a0ee9a5-2dd9-41de-a9cd-dc95f57bda63
Post summary
A PoC with functional exploit code for CVE‑2026‑73678 is announced, and a link to the exploit on ExploitGrid is provided.
🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: EGE-GH-z2Wb7PG ( CVE-2026-72898 ) EGE-GH-UkSJfvx ( CVE-2026-73678 ) EGE-GH-MKUk78n ( CVE-2023-22621 ) EGE-GH-EjpQM0Q ( CVE-2025-3243, CVE-2025-32433 ) EGE-GH-seDm3r2 ( CVE-2025-55182 ) ..🧵👇
Post summary
ExploitGrid publishes a short list of newly disclosed CVEs without providing any PoC, exploit details, or mitigation information.
🧠 MindsDB Minds Platform v26.1.0: unauthenticated RCE via scratchpad exec(). No auth needed to run arbitrary OS commands. CVSS 10. CVE-2026-73678 #cybersecurity #ciso #vulnerabilities #mssp https://secalerts.co/vulnerability/CVE-2026-73678?utm_campaign=x https://t.co/uNkBJqZJ2x
Post summary
The tweet announces an unauthenticated remote‑code‑execution vulnerability (CVE‑2026‑73678) in MindsDB Minds Platform v26.1.0, noting that any user can run arbitrary OS commands via scratchpad exec() and the issue has a CVSS score of 10.
CVE-2026-73678: unauthenticated RCE in MindsDB's Cowork agent. No auth on the API, CORS *, and the scratchpad exec()s whatever the LLM writes. Bring your own LLM key — the victim doesn't need one. CVSS 10.0. #LLM #RCE #MindsDB https://www.hunt-benito.com/blog/bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdbs-cowork-via-the-anton-agents-scratchpad-exec/ https://t.co/jsYFGnItCR
Post summary
The post announces CVE-2026-73678, an unauthenticated RCE in MindsDB's Cowork agent, and points to a blog that likely contains more details about the flaw.
🔐🚨 MindsDB Minds Platform — CVSS 10.0 CRITICAL CVE-2026-73678: Unauthenticated RCE via Anton AI agent scratchpad → https://threataft.com/articles/mindsdb-minds-platform-cve-2026-73678 #cybersecurity #infosec #MindsDB #AI #RCE #CVSS10 #ThreatIntel
Post summary
The post announces a newly disclosed critical CVE (CVE-2026-73678) affecting MindsDB Minds Platform, providing a link for details but no evidence of active exploitation or a public exploit tool.
🔒 #CyberSecurity CVE-2026-73678: MindsDB Unauthenticated RCE via Anton Agent Scratchpad — Detect… "The NVD has published CVE-2026-73678, a critical, network-exploitable vulnerability…" 🔗 https://securityarsenal.com/blog/cve-2026-73678-mindsdb-unauthenticated-rce-via-anton-agent-scratchpad-detection-and-remediation-guide #CyberSecurity #ThreatIntel #cve202673678 #critical #cve
Post summary
The post announces CVE-2026-73678, describing it as a critical unauthenticated RCE without noting a PoC, exploit tool, or active exploitation.