What happened
NVD published CVE-2026-73678 (CVSS 10.0, Critical) on 2026-08-14, describing an unauthenticated remote code execution vulnerability in MindsDB's Minds Platform where crafted prompts submitted to the unprotected /api/v1/responses/ endpoint reach the Anton agent's execution logic, allowing arbitrary OS command execution.
Why it matters
This is a maximum-severity (CVSS 10.0) unauthenticated RCE in an AI agent orchestration platform — an attacker needs no credentials to fully compromise the host running the agent, exposing any connected databases, secrets, or downstream systems the agent has access to.
Attack vector
Unauthenticated attacker submits a crafted prompt to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's code-execution path and allows arbitrary OS command execution with no authentication required
Affected systems
MindsDB Minds Platform ≤ 26.1.0 (Anton self-improving agent component)
Mitigation
Upgrade MindsDB Minds Platform beyond 26.1.0; restrict network exposure of the /api/v1/responses/ endpoint until patched