MindsDB BYOM unauthenticated RCE is CVE-2026-7711

What happened

MindsDB has a remote code execution flaw in its Bring Your Own Model (BYOM) feature. It is tracked as CVE-2026-7711.

This is not fresh. VulDB published the CVE on 3 May 2026. A public write-up by the JD Security SHENYI Team was uploaded to GitHub on 17 April 2026. ThreatWire is covering it now because the write-up is still circulating and self-hosted installs remain easy to leave open.

BYOM is meant to let users upload custom Python model code. The flaw is that, in one execution mode, that code runs as soon as the engine is created. On default self-hosted setups before 26.0.0, the upload path needed no login.

Who is affected

The CVE record and GitHub advisory GHSA-9f6m-65v9-x9g2 list MindsDB up to 26.0.1. VulDB writes the version as "26.01".

The reporter reproduced on v25.11.0. ThreatWire checked the HTTP handlers for the 25.x line and for 26.0.0 and later:

• v25.11.0 through v25.14.1: BYOM upload routes have no server-side enablement check. HTTP auth defaults to off.
• v26.0.0 and later: BYOM is disabled by default. An admin must turn it on with an environment variable or a config flag. HTTP auth still defaults to off.

MindsDB Cloud is a different case. The project's own comments say cloud leaves BYOM off unless an admin enables it. ThreatWire has not tested a cloud tenant.

What is confirmed

BYOM exposes an HTTP upload route under the handlers API. A client can send model code as form data and ask for the "inhouse" type.

In that mode, MindsDB builds what its source calls an unsafe model wrapper. That wrapper loads the uploaded code with Python's exec. The load happens when the engine is created, so top-level code in the file runs at once. Later checks on the model's train and predict methods do not stop that first run.

Two defaults make this worse on older self-hosted installs:

• HTTP authentication is off unless you set username and password.
• Inhouse BYOM is on for local installs unless you turn it off. Cloud turns it off by default.

VulDB scores the flaw CVSS 3.1 7.3 (High). The CVSS 4.0 score is 6.9. The record maps it to CWE-284 and CWE-434. NVD has deferred analysis.

What the public write-up shows

The linked write-up walks through the call chain from the BYOM upload route to the exec call. It includes a reproduction script. ThreatWire reviewed the text and the repository metadata. We did not run the script or any of its code.

The write-up is the only public PoC we found. The CVE record links to it and tags it as exploit material.

What the vendor did

MindsDB has no security advisory that names CVE-2026-7711. The CVE record says the vendor was contacted early and did not respond.

Separately, on 24 February 2026, MindsDB merged PR #12236, "Disable BYOM by default". It shipped in v26.0.0 the next day. That change does not remove the unsafe execution path. It stops the BYOM upload routes unless an admin opts in.

Snyk's advisory lists 26.1.0rc1 or later as the fix. The current release on GitHub is v26.1.0 (23 April 2026). Its notes do not mention this CVE.

In later trees the BYOM handler was moved out of the main package into the community-handlers repository. ThreatWire did not fully re-test that path.

Exploitation status

The CVE is not in the CISA KEV catalog. CISA's SSVC assessment on the CVE record lists exploitation as poc. No active attacks have been reported.

What to do now

1. Upgrade to MindsDB 26.1.0 or the newest release you can run.
2. Leave BYOM off unless you need it. On 26.0.0 and later, that is the default. On older builds, set MINDSDB_BYOM_ENABLED=false or the matching config key.
3. Turn on HTTP authentication. Set a username and password through MindsDB's documented environment variables, and prefer binding the API to a trusted network only.
4. Do not expose the HTTP API to the internet. Default ports include 47334. Put it behind a reverse proxy with auth if remote access is required.
5. If you must use BYOM, prefer the sandboxed virtualenv type over inhouse. Keep MINDSDB_BYOM_INHOUSE_ENABLED off.
6. Audit existing BYOM engines. Remove any you did not create. Rotate credentials the MindsDB process can reach.
7. Treat any internet-facing, unauthenticated pre-26.0.0 install as compromised until you have checked it.

Related coverage

Full record: CVE-2026-7711 on ThreatWire.

For another AI-tool command-execution flaw we covered, see Goose recipe command execution (CVE-2026-85623). Browse the CVE tracker and actively exploited CVEs.

Sources: CVE.org, NVD, the GitHub Advisory Database, VulDB, MindsDB PR #12236 and the v26.0.0 release, MindsDB's BYOM docs, Snyk and the JD Security SHENYI Team write-up. Links are in the references list.