GitHub Advisoryadvisory · PyPI

GHSA-9f6m-65v9-x9g2 MindsDB has an Improper Access Control Issue

MEDIUM Published 2026-05-04 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-7711
Ecosystem
PyPI
Packages
MindsDB
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-284
Reviewed
2026-05-08

Affected packages

• PyPI MindsDB: <= 26.0.1 (no fix yet)

Description

A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2026-7711 A weakness has been identified in MindsDB up to 26.01. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References