Sign in
Deutsch English Español Polski
Medium

MindsDB has an Improper Access Control Issue

  • Disclosed: 04.05.2026
  • Updated: 11.10.2026 14:18

A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) mindsdb <= 26.0.1 no fix

References

CVSS score 7.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness (CWE)
CWE-284
Platform
Python (PyPI)
Package
mindsdb
Disclosed
04.05.2026
Updated
11.10.2026 14:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-2648 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-9f6m-65v9-x9g2 - CC BY 4.0

Vulnerability history: mindsdb

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (22) in the archive
Total entries
22
First → latest
03.2023 05.2026
Without a fix
7
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 16
  • Medium 5

Disclosures per year

Severity:
  1. MindsDB has an Improper Access Control Issue this entry
    Medium · 7.3 CVE-2026-7711 <= 26.0.1 no fix
  2. MindsDB: Path Traversal in /api/files Leading to Remote Code Execution
    High · 8.8 CVE-2026-27483 < 25.9.1.1 25.9.1.1
  3. A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/security.py of the component File Upload. Such
    High · 7.3 CVE-2026-2531 < 26.0.0rc1 26.0.0rc1
  4. MindsDB has improper sanitation of filepath that leads to information disclosure and DOS
    High · 8.1 CVE-2025-68472 < 25.11.1 25.11.1
  5. MindsDB Eval Injection vulnerability
    High · 8.8 CVE-2024-45847 >= 23.11.4.2, < 24.7.4.1 24.7.4.1
  6. Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘fin
    High · 7.5 CVE-2024-45855 >= 23.10.2.0 no fix
  7. Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describ
    High · 7.5 CVE-2024-45854 >= 23.10.3.0 no fix
  8. An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases creat
    High · 8.8 CVE-2024-45851 >= 23.10.5.0, < 24.7.4.1 24.7.4.1
  9. An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’
    High · 8.8 CVE-2024-45848 >= 23.12.4.0, < 24.7.4.1 24.7.4.1
  10. Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with.
    High · 8.8 CVE-2024-45852 >= 23.3.2.0 no fix
  11. An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases creat
    High · 8.8 CVE-2024-45849 >= 23.10.5.0, < 24.7.4.1 24.7.4.1
  12. An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases creat
    High · 8.8 CVE-2024-45850 >= 23.10.5.0, < 24.7.4.1 24.7.4.1
  13. Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a
    High · 7.5 CVE-2024-45853 >= 23.10.2.0 no fix
  14. An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT
    High · 8.8 CVE-2024-45846 >= 23.10.3.0, < 24.7.4.1 24.7.4.1
  15. MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
    High · 9.3 CVE-2024-24759 < 23.12.4.2 23.12.4.2
  16. GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182
    High · 9.1 CVE-2023-50731 < 23.11.4.1 23.11.4.1
  17. MindsDB can be made to not verify SSL certificates
    Critical · 9.1 CVE-2023-38699 < 23.7.4.0 23.7.4.0
  18. mindsdb arbitrary file write when extracting a remotely retrieved Tarball
    High · 7.5 CVE-2023-30620 < 23.2.1.0 23.2.1.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.