ZDI-26-707: (0Day) MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability
ZDI disclosed an unpatched code injection RCE (CVE-2026-92207, CVSS 8.8) in MindsDB's OpenBBtable feature, exploitable by authenticated remote users.
ZDI-26-708 describes a code injection remote code execution vulnerability in MindsDB's OpenBBtable functionality. A remote attacker with valid authentication can execute arbitrary code on affected installations. The flaw is rated CVSS 8.8, tracked as CVE-2026-92207, and published as a 0day advisory without a referenced vendor patch.
- Unpatched code injection RCE in MindsDB
- Requires authentication for exploitation
- Assigned CVE-2026-92207 with CVSS 8.8
- Published as ZDI 0day advisory
- CVEs
- CVE-2026-92207
- Vendors
- MindsDBZero Day Initiative
- Products
- MindsDBOpenBBtable
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92207 | Authenticated code injection RCE in MindsDB OpenBBtable | 8.8 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.