Vulnerability · Published May 3, 2026 · Assigned by VulDB

CVE-2026-7711MindsDB Engine proc_wrapper.py exec unrestricted upload

High 7.3

In plain English

A high-severity unrestricted file upload in MindsDB. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 79.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	mindsdb	no fix listed	GHSA-9f6m-65v9-x9g2
PyPI	mindsdb	no fix listed	PYSEC-2026-2648

Affected products (as reported)

Vendor	Product	Versions
n/a	MindsDB	26.01

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-360887 | MindsDB Engine proc_wrapper.py exec unrestricted upload vdb-entry, technical-description
VDB-360887 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #806822 | mindsdb <=26.01 Remote Code Execution third-party-advisory
https://github.com/nn0nkey/JD-Security-SHENYI-Team/blob/main/MindsDB_BYOM_RCE.md exploit