MindsDB: Unauthenticated RCE, Max CVSS Score

MindsDB’s Minds Platform has a CVSS 10.0 unauthenticated remote code execution vulnerability. All versions through 26.1.0 are affected. CVSS 10.0 is the maximum possible score, and this one earns it: no authentication, no user interaction, full remote code execution as the MindsDB process user.

If your MindsDB instance is reachable from the network, stop reading and firewall the port. Then come back.

What’s broken

Two API endpoints ship without authentication in affected versions:

• PUT /api/v1/settings/ — lets any caller set the LLM API key and model configuration for the running instance
• POST /api/v1/responses/ — routes prompts to the Anton agent’s scratchpad tool, which calls Python’s exec() on processed input without sandboxing

Together they create a straightforward path to OS command execution. An attacker can configure the instance to use an attacker-controlled API key, craft a prompt that the scratchpad routes into code execution, and run arbitrary commands as whatever user owns the MindsDB process.

MindsDB functions as an LLM and database integration layer in production — it connects to databases, LLM providers, and internal APIs, and commonly holds or has access to database credentials, model API keys, and internal data. That’s what’s at risk here.

Action items

Update immediately. The NVD advisory documents version 26.1.0 and earlier as vulnerable. Check MindsDB’s release channel for the patched version and apply it.

While you’re patching or testing:

• Firewall the API port. MindsDB’s API surface should not be internet-accessible regardless of this CVE. If it is, that’s the more urgent problem.
• Rotate credentials. Assume any database connections, model API keys, or other secrets accessible to the process may have been read. Rotate before trusting the instance again.
• Review process logs for unexpected command execution, configuration changes, or anomalous API calls to /api/v1/settings/.

Priority call

Internet-accessible deployments: this is a P0 incident. CVSS 10.0 with no authentication and no user interaction means exploitation is trivial for anyone who can reach the port. Firewall first, patch as soon as you can pull a fixed build, then audit.

Internal deployments behind a hard network boundary: still patch this week. The attack surface here is your MindsDB process and everything it can touch — database connections, API keys, and whatever data those systems hold. That’s not exposure you want sitting on an unpatched binary.

---

CVE-2026-50027 — a separate unauthenticated access vulnerability in mcp-memory-service — was patched this week. LLM tooling infrastructure continues to be an active target for this class of missing-auth bugs.