CVE-2026-7711 MindsDB Engine proc_wrapper.py exec unrestricted upload
Remote attackers can exploit unrestricted file upload in MindsDB Engine to achieve code execution via the proc_wrapper.py exec function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-7711?
CVE-2026-7711 is a medium-severity vulnerability in MindsDB, published on 3 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2026-7711?
3 open source packages ship an affected version, including mindsdb and MindsDB.
| Package | Affected | Fixed in |
|---|---|---|
mindsdb PyPI | All versions to 26.0.1 | None |
mindsdb PyPI | All versions to 26.0.1 | None |
MindsDB PyPI | All versions to 26.0.1 | None |
How do I fix CVE-2026-7711?
No fix has been published for CVE-2026-7711 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-7711 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-7711 exists.
Sources
Also known as GHSA-9f6m-65v9-x9g2, PYSEC-2026-2648.