MindsDB - Remote Code Execution

MindsDB 25.9.1.1 contains a remote code execution caused by path traversal in the /api/files upload file module, letting authenticated attackers write arbitrary files and execute commands, exploit requires authentication. id: CVE-2026-27483 info: name: MindsDB - Remote Code Execution author:...

MindsDB -DNS Rebinding SSRF Protection Bypass

Detects DNS rebinding vulnerability that allows bypass of SSRF protection. The vulnerability exists in the URL validation mechanism where DNS resolution is performed without considering DNS rebinding attacks. id: CVE-2024-24759 info: name: MindsDB -DNS Rebinding SSRF Protection Bypass author: Lee...

cve-2026-27483

CVE-2026-27483 MindsDB 경로 탐색을 통한 RCE PoC 이 PoC 스크립트는 다음 GitHub 권고를 기반으로 합니다. 기본적으로 MindsDB는 인증을 사용하지 않습니다 PoC는 인증되지 않은 모드와 인증된 모드를 모두 지원합니다 /api/handlers/를 쿼리하여 사용 가능한 핸들러를 찾고, 설치되지 않은 핸들러 이름을 사용합니다. PoC는 /venv/lib/python3.10/site-packages/pip/init.py를 덮어씁니다. 파이썬 리버스 셸이 위 경로에 작성된 후 트리거됩니다...

cve-2026-27483-lab

CVE-2026-27483 ラボ - エンタープライズ脆弱性学習環境 CVE-2026-27483（MindsDB パストラバーサル RCE）を学習、テスト、防御するための、完全で現実的なエンタープライズグレードの Docker ベースのラボ です。 🎯 クイックスタート root@kitploit: Clone the repository git clone https://github.com/nabhan-mohy/cve-2026-27483-lab.git cd cve-2026-27483-lab Copy environment file cp .env.example...

CVE-2026-73678-PoC

CVE-2026-73678 — MindsDB Minds Platform 인증 없는 RCE CVSS 10.0 CVSS 10.0 Critical · CWE-94 / CWE-306 · GHSA-jcxw-h8ph-pxpv · VulnCheck 요약 Minds Platformmindsdb/mindshub의 오픈소스 백엔드, 이전에는 mindsdb/minds-platform은 완전히 인증 없이 POST /api/v1/responses/OpenAI 호환 Responses API, 포트 26866를 노출합니다. 인증 미들웨어가 없습니다 —...

Exploit for CVE-2026-73678

CVE-2026-73678 — Unauthenticated RCE in MindsDB Minds Platform...

CVE-2026-73678

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

CVE-2026-73678 MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

EUVD-2026-58787

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

CVE-2026-73678

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

CVE-2026-73678 MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

CVE-2026-73678

CVE-2026-73678 enables unauthenticated remote code execution in MindsDB Minds Platform

PT-2026-72088

Name of the Vulnerable Software and Affected Versions MindsDB Minds Platform versions prior to 26.1.1 Description An unauthenticated remote code execution flaw allows attackers to execute arbitrary OS commands. The issue occurs when crafted prompts are submitted to the unprotected 'POST...

Exploit for Path Traversal in Mindsdb

CVE-2026-27483 Lab - Enterprise Vulnerability Learning Environ...

PYSEC-2026-2648 MindsDB has an Improper Access Control Issue

A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byomhandler/procwrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit ha...

PYSEC-2026-1629 MindsDB Eval Injection vulnerability

An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on the server. If a specially crafted ‘UPDATE’ query containing Python code is run against a database created with the specified integration...

PYSEC-2026-1628 MindsDB Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI...

CVE-2026-7711

A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byomhandler/procwrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit ha...

CVE-2026-7712

A security vulnerability has been detected in MindsDB up to 26.01. Affected is the function pickle.loads of the component Pickle Handler. The manipulation leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vend...

📄 MindsDB 25.9.1.1 Path Traversal

MindsDB version 25.9.1.1 suffers from a path traversal vulnerability. Exploit Title: MindsDB 25.9.1.1 - Path Traversal Date: 06-03-2026 Exploit Author: Lohitya Pushkar thewhiteh4t Vendor Homepage: https://mindsdb.com/ Software Link: https://github.com/mindsdb/mindsdb Version: not installed handle...