CVE-2026-92207: MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability

High severity · published Oct 21, 2026

CVE-2026-92207

MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability

New

8.8

CVSS

0.7%

EPSS

On KEV

Description

MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the OpenBBtable class. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28388.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 53% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

MindsDB · MindsDB

25.10.1 · source: vendor

In the news

VulnerabilityHigh

ZDI-26-707: (0Day) MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-92207.

CVE-2026-92207

Sep 16, 2026·Zero Day Initiative

Affected product

MindsDB

All MindsDB CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-92207

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-92207

www.zerodayinitiative.com

https://www.zerodayinitiative.com/advisories/ZDI-26-707/