A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-73678, affects MindsDB Minds Platform versions 26.1.0 and earlier. The flaw stems from improper validation of user input in the unprotected POST /api/v1/responses/ endpoint, which interfaces with the Anton agent's scratchpad tool. Attackers can exploit this by first configuring a custom LLM API key via the unauthenticated PUT /api/v1/settings/ endpoint, then submitting malicious prompts that trigger arbitrary Python code execution through the exec() function. This vulnerability bypasses sandboxing protections, enabling unauthenticated users to execute operating system commands with the privileges of the affected service. All deployments of MindsDB 26.1.0 and earlier versions are affected. Exploitation could lead to full system compromise, data exfiltration, or lateral movement within networks. Immediate remediation is strongly advised. Mitigation steps include upgrading to a patched version, disabling unnecessary API endpoints, and implementing strict access controls for API key configuration. Organizations should review logs for suspicious API activity and monitor for unauthorized code execution attempts.