---
id: "CVE-2026-92207"
kind: "vulnerability"
aliases: ["CVE-2026-92207"]
title: "MindsDB: authenticated user can run Python code through OpenBBtable"
severity: "high"
cvss: 8.8
epss: 0.00699
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "mindsdb", "fixed": [], "affected": "25.10.1 (later versions unknown)", "ecosystem": "pypi"}, {"name": "mindsdb", "fixed": ["26.1.0 (unconfirmed)"], "affected": "<= 25.10.1 (up to < 26.1.0 probable)", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "mindsdb", "python", "rce", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-10-21T18:17:31+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92207", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:16:52+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:33:59+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-92207", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# MindsDB: authenticated user can run Python code through OpenBBtable

MindsDB's OpenBBtable class passes a user-supplied string to Python execution without validating it. An attacker with a valid account can run arbitrary code as the MindsDB service account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:mindsdb affected 25.10.1 (later versions unknown) fixed ?
- pypi:mindsdb affected <= 25.10.1 (up to < 26.1.0 probable) fixed 26.1.0 (unconfirmed)

## How to check

pip show mindsdb: 25.10.1 and earlier are affected; versions before 26.1.0 are probably affected. Check with: grep -n eval mindsdb/integrations/handlers/openbb_handler/openbb_tables.py in site-packages. Check SHOW DATABASES for an openbb engine datasource.

## Fix

Upgrade pypi:mindsdb to 26.1.0 or later (likely; verify that openbb_tables.py in your install no longer calls eval, and that _resolve_openbb_command exists). Until then, remove or disable the OpenBB integration and restrict access to MindsDB.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92207
- 2026-10-23T22:16:52+00:00 analyst — ZDI-26-707 (0day, vendor never responded; reported 2025-11-20, published 2026-09-16) and CVE record: affected 25.10.1 only listed, no fixed version. Did not verify default reachability of OpenBBtable or search social.
- 2026-10-23T22:33:59+00:00 analyst — New: upstream fix found. PR #12290 (merged 2026-03-30 into the release branch, commit 100e10c) removes eval() in OpenBBtable.select() and adds _resolve_openbb_command. ZDI called it a 0day, but the fix predates the CVE. Release containing it is not confirmed: v26.1.0 (2026-04-23) is the likely first one, but its notes page did not list the PR, and v26.0.1 (2026-03-03) predates the fix. Query path: the sink is OpenBBtable.select(), reached by SELECT against an OpenBB datasource; the exact endpoint is not confirmed.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-92207

## Documents

- [advisory] ZDI-26-707 MindsDB OpenBBtable https://www.zerodayinitiative.com/advisories/ZDI-26-707/
- [describes] CVE record CVE-2026-92207 https://www.cve.org/CVERecord?id=CVE-2026-92207
- [fix] PR #12290 Fix OpenBB command execution by removing eval https://github.com/mindsdb/mindsdb/pull/12290
- [mentions] MindsDB v26.1.0 https://github.com/mindsdb/mindsdb/releases/tag/v26.1.0

## From the sources

MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability.

The specific flaw exists within the OpenBBtable class. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28388.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_