ZDI-26-707: (0Day) MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability
ZDI disclosed an unpatched code injection RCE (CVE-2026-92207, CVSS 8.8) in MindsDB's OpenBBtable feature, exploitable by authenticated remote users.
45
CVE-2026-92207
Authenticated code injection RCE in MindsDB OpenBBtable
- CVSS 3.0
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
MindsDB's OpenBBtable class fails to validate a user-supplied string before using it to run Python code. A remote attacker who is already authenticated can trigger it over the network with no further user interaction and run arbitrary code as the service account. Affected and fixed versions are not stated.
What to do: MindsDB has not listed a fixed version for CVE-2026-92207, and no workaround is documented.
| Product | Affected |
|---|---|
| MindsDB | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the OpenBBtable class. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28388.
- Weakness
- CWE-94
- Vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H