Medium severity · published May 3, 2026
CVE-2026-7712
MindsDB Pickle pickle.loads deserialization
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A security vulnerability has been detected in MindsDB up to 26.01. Affected is the function pickle.loads of the component Pickle Handler. The manipulation leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
MindsDB · Mindsdb
26.01 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7712
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7712
github.com
https://github.com/nn0nkey/JD-Security-SHENYI-Team/blob/main/MindsDB_Pickle_RCE.md
vuldb.com
https://vuldb.com/submit/806827
vuldb.com
https://vuldb.com/vuln/360888
vuldb.com
https://vuldb.com/vuln/360888/cti
More from MindsDB
9.1
CVE-2025-68472
MindsDB is a platform for building artificial intelligence from enterprise data
9.1
CVE-2024-24759
MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
9.1
CVE-2023-50731
MindsDB is a SQL Server for artificial intelligence
8.8
CVE-2026-92207
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability
8.8
CVE-2026-27483
MindsDB has Path Traversal in /api/files Leading to Remote Code Execution