CVE-2026-92207High· 8.8▾ Abyssal0dayMindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability. …
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 48.4 · likelihood 0 · exploitation 25
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability.
The specific flaw exists within the OpenBBtable class. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28388.
MindsDB 25.10.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73678Critical· 10.0MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POS…
CVE-2026-86173High· 7.5MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list
CVE-2023-49795Medium· 6.5Server-Side Request Forgery in mindsdb
CVE-2023-30620High· 7.5mindsdb arbitrary file write when extracting a remotely retrieved Tarball
CVE-2026-7711High· 7.3MindsDB has an Improper Access Control Issue
CVE-2026-27483High· 8.8MindsDB: Path Traversal in /api/files Leading to Remote Code Execution