Read the docs
TI-2026-78897 Aliases CVE-2026-92207GHSA-wc4f-6wjm-cqwf

Code injection in MindsDB OpenBBtable allows remote code execution

Priority MEDIUM 41CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

MindsDB versions from 25.10.1 are affected. The OpenBBtable class does not validate a user-supplied string before executing it as Python code (CWE-94). An authenticated remote attacker can execute arbitrary code in the context of the service account.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the OpenBBtable class. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28388.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00699 53rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mindsdbMindsDB25.10.1—No fix listedCNA
  • MindsDB Vendormindsdb Affected 25.10.1 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:*——mindsdb
  • cpe:2.3:a:mindsdb:mindsdb:*:*:*:*:*:*:*:* Versions — — ·mindsdb

Remediation

The sources list no fixed version for MindsDB.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-92207
  2. 2026-10-21 Alias added: GHSA-wc4f-6wjm-cqwf
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-30 CISA SSVC decision points changed
  5. 2026-10-30 Priority changed: LOW → MEDIUM

References

Other 1

  • TI-2026-51757 MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec() CVSS 4.0CRITICAL 10.0
  • TI-2024-16276 MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding CVSS 3.1CRITICAL 9.3
  • TI-2026-58962 MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler CVSS 4.0HIGH 8.7
  • TI-2026-21890 MindsDB has Path Traversal in /api/files Leading to Remote Code Execution CVSS 3.1HIGH 8.8
  • TI-2024-30805 Code injection in mindsdb CVSS 3.1HIGH 8.8
  • TI-2024-30804 Code injection in mindsdb CVSS 3.1HIGH 8.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences