PT-2026-36729 · Mindsdb · Mindsdb

Nn0Nkey · Published 2026-05-03 · Updated 2026-05-04 · CVE-2026-7712

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MindsDB versions prior to 26.01

Description A remote deserialization issue exists within the Pickle Handler component. The flaw occurs during the execution of the pickle.loads() function, allowing an attacker to manipulate data to achieve deserialization.

Recommendations Update to a version later than 26.01. As a temporary workaround, restrict the use of the pickle.loads() function within the Pickle Handler component.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-20

CWE-502

Related Identifiers

CVE-2026-7712

Affected Products

Mindsdb

References · 9

• 🔥 https://github.com/nn0nkey/JD-Security-SHENYI-Team/blob/main/MindsDB_Pickle_RCE.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7712 · Security Note
• https://twitter.com/infoflowcloud/status/2051111074691223824 · Twitter Post
• https://vuldb.com/vuln/360888 · Note
• https://vuldb.com/submit/806827 · Note
• https://t.me/CVEtracker/52592 · Telegram Post
• https://vuldb.com/vuln/360888/cti · Note
• https://twitter.com/CVEnew/status/2051110086324445401 · Twitter Post
• https://t.me/cveNotify/161958 · Telegram Post