CVE-2026-7711: RCE in MindsDB — when the client itself chooses an unsafe Python execution mode

A technical analysis of CVE-2026-7711 in MindsDB has been published. The vulnerability enables remote execution of arbitrary Python code through the BYOM (Bring Your Own Model) mechanism. The core issue is not bypassing uploaded-file validation, but an architectural flaw: the HTTP client can select an unsafe execution mode, while API authentication is disabled by default.

MindsDB provides two execution modes for custom models: • ModelWrapperSafe — runs uploaded code in a separate process within a Python virtual environment. • ModelWrapperUnsafe — executes code directly inside the MindsDB worker process.

Exploitation chain: The attacker sends PUT /api/handlers/byom/<name> with a Python file in the code field and the parameter type=inhouse. The server converts inhouse to BYOM_TYPE.INHOUSE, selecting ModelWrapperUnsafe. The alternative value VENV selects ModelWrapperSafe. The uploaded code is passed to import_string() in proc_wrapper.py, which calls exec(code, module.__dict__). All top-level statements execute before the server checks whether the model class provides train() and predict() methods. Consequently, rejecting an invalid model does not prevent the malicious code from executing.

The PoC invokes subprocess.run(['whoami']) and writes the output to /tmp/pwned.txt. The command runs with the privileges of the MindsDB worker process. The /api/handlers namespace is listed in protected_namespaces, but the authentication check is enforced only when config["auth"]["http_auth_enabled"] is set to True. This setting defaults to False.

In the examined self-hosted deployment, the HTTP API listens on 0.0.0.0:47334, and BYOM is enabled. In MindsDB's cloud deployment mode, a separate safeguard exists: MINDSDB_BYOM_ENABLED defaults to false. Therefore, the findings should not automatically be assumed to apply to the MindsDB cloud service.

Notably, the file-upload mechanism works as designed: the server saves the uploaded file to a temporary directory and subsequently passes its contents to exec(). The client also controls the choice between the safe and unsafe execution modes through a regular multipart form field.

Mitigation: Do not expose the vulnerable BYOM API to untrusted networks. Enable HTTP authentication, restrict the ability to upload custom models, and prevent untrusted clients from selecting INHOUSE execution. Authentication restricts access, but it does not make ModelWrapperUnsafe a sandbox.

Article: https://nefariousplan.com/posts/mindsdb-byom-form-picks-modelwrapperunsafe

PoC: https://github.com/nn0nkey/JD-Security-SHENYI-Team/blob/main/MindsDB_BYOM_RCE.md