MindsDB Minds Platform Unauthenticated RCE via Scratchpad Tool exec()

Technical Analysis

The vulnerability chains two unauthenticated endpoints: PUT /api/v1/settings/ allows an attacker to register their own LLM API key, and POST /api/v1/responses/ accepts free-form prompts that are passed to the Anton agent's planner/tool-invocation logic. The agent's 'scratchpad' tool is designed to run Python code for computation, but it calls exec() directly on LLM-generated source without any sandboxing, input validation, or privilege separation, so any Python payload the attacker can coerce the LLM into emitting is executed with the full OS privileges of the desktop application process. This crosses the boundary from a natural-language prompt (model layer) directly into arbitrary OS command execution (tool layer), effectively turning prompt injection into a code execution primitive. Because authentication is absent on both the configuration and inference endpoints, no prior access or valid session is required, making this a zero-click, network-reachable RCE against any exposed instance.

Affected Systems

MindsDB Minds Platform

Detection Signatures

• PUT requests to /api/v1/settings/ from unauthenticated or unexpected source IPs
• POST requests to /api/v1/responses/ containing code-like constructs, import statements, os.system/subprocess references, or instructions such as 'use the scratchpad tool to run...'
• Unexpected child processes spawned by the MindsDB/Minds desktop application process
• Outbound network connections or file access to SSH key directories (~/.ssh) originating from the agent process
• Anomalous exec()/eval() calls logged within agent tool execution traces

Remediation Steps

1. 1

   Patch immediately

   Upgrade MindsDB Minds Platform beyond version 26.1.0 to the vendor-supplied fixed release as soon as it is available.

2. 2

   Enforce authentication on all API endpoints

   Require authentication and authorization on /api/v1/settings/ and /api/v1/responses/ (and any other administrative or inference endpoints) before allowing configuration changes or prompt submission.

3. 3

   Sandbox tool execution

   Replace direct exec() calls in the scratchpad tool with a hardened, sandboxed execution environment (e.g., containerized, resource-limited, network-isolated interpreter) and disallow arbitrary code execution as a default agent capability.

4. 4

   Restrict network exposure

   Do not expose the Minds Platform API to the public internet; place it behind a VPN, firewall, or reverse proxy with strict access controls until patched.

5. 5

   Principle of least privilege

   Run the agent/application process under a low-privilege service account without access to SSH keys, credential stores, or sensitive environment variables.

6. 6

   Monitor and alert

   Deploy the detection signatures above in EDR/SIEM to flag suspicious tool invocations, settings changes, and process spawning from the agent runtime.