CVE-2026-7711 | MindsDB up to 26.01 Engine proc_wrapper.py exec unrestricted upload

A vulnerability categorized as critical has been discovered in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom_handler/proc_wrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload.

This vulnerability is handled as CVE-2026-7711. The attack can be executed remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.