CVE-2026-7711

CVE-2026-7711 is a remote code execution flaw in MindsDB, an open-source AI and data platform. It was published by VulDB on 3 May 2026. This is not new today.

The flaw is in the Bring Your Own Model (BYOM) feature. BYOM lets users upload custom Python model code through the HTTP API. In the "inhouse" execution mode, that code is run when the engine is created.

The CVE record maps it to CWE-284 and CWE-434. VulDB and GitHub Advisory Database score it CVSS 3.1 7.3 (High). The CVSS 4.0 score is 6.9. The full vector is in the CVSS field. NVD lists the record as deferred.

Affected: MindsDB up to and including 26.0.1, per the CVE and GHSA-9f6m-65v9-x9g2. The VulDB text writes this as "26.01".

Fixed: MindsDB has no security advisory for this CVE. PR #12236, merged 24 February 2026 and shipped in v26.0.0, disables BYOM by default. Snyk lists 26.1.0rc1 or later as the fix. HTTP authentication is still off by default in recent releases.

Cloud vs self-hosted. MindsDB's own code comments say cloud deployments leave BYOM off unless an admin turns it on. Self-hosted installs before 26.0.0 had BYOM on by default.

Exploitation. Not in the CISA KEV catalog. CISA's SSVC assessment on the CVE record lists exploitation as poc. No attacks have been reported.

PoC. A public write-up by the JD Security SHENYI Team is linked from the CVE record. ThreatWire reviewed it without running any of its code. The PoC URL is in the field above; it is not repeated here.

Credit: JD Security SHENYI Team, via VulDB. The CVE record says the vendor was contacted early and did not respond.

Read the full research note and hardening checklist.