Which versions of Comma AI Openpilot are affected by CVE-2026-12191?

Comma AI Openpilot 0.11 contains an insecure deserialization vulnerability (CVE-2026-12191) that allows authenticated local users to execute arbitrary code on vehicles running this autonomous driving…

How to fix or mitigate CVE-2026-12191?

Within 24 hours: inventory all deployed Openpilot 0.11 installations and isolate systems that cannot be immediately upgraded. Within 7 days: implement compensating controls (local access restrictions, disable pickle-based features where possible, restrict network access to modeld component). Within 30 days: execute complete migration plan to Openpilot 0.12 or later, or transition to alternative autonomous driving software with active vendor support.

Comma AI Openpilot CVE-2026-12191

Q: What is the CVSS score of CVE-2026-12191?

CVE-2026-12191 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-36670 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-14 VulDB

GHSA-wp3f-pcm8-3jxw

Deserialization Openpilot

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local access to the device is required (AV:L) and the attacker needs low privileges to write the pickle file modeld will load (PR:L); deserialization yields full RCE in the modeld process, giving C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 14, 2026 - 23:28 vuln.today

CVSS changed

Jun 14, 2026 - 23:22 NVD

8.5 (HIGH) 7.1 (HIGH)

DescriptionCVE.org

A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdrive/modeld/modeld.py of the component Pickle Module. The manipulation results in deserialization. The attack is only possible with local access. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Insecure deserialization in Comma AI Openpilot 0.11 allows a local authenticated attacker to achieve code execution by supplying a malicious pickle payload to the pickle.load/pickle.loads calls in selfdrive/modeld/modeld.py. The flaw requires local access with low privileges and no public exploit identified at time of analysis, but the vendor reportedly did not respond to coordinated disclosure, leaving the issue unpatched. CVSS 4.0 scores it 7.1 (High) with full confidentiality, integrity, and availability impact on the vulnerable system.

Technical ContextAI

Openpilot is Comma AI's open-source advanced driver-assistance system (ADAS) that runs on dedicated hardware (e.g., comma three) inside a vehicle to control steering, acceleration, and braking. The modeld component (selfdrive/modeld/modeld.py) is the model daemon responsible for loading and running the neural network driving model. The vulnerability is a CWE-502 (Deserialization of Untrusted Data) issue caused by use of Python's pickle.load/pickle.loads on attacker-controllable input - pickle is well known to allow arbitrary code execution during deserialization via crafted __reduce__ gadgets, so any path that feeds untrusted bytes into pickle is effectively a code-execution sink. The single CPE cpe:2.3:a:comma_ai:openpilot:*:*:*:*:*:*:*:* indicates the version range is not narrowly bounded in the published CPE data, though the description names 0.11 specifically.

RemediationAI

No vendor-released patch identified at time of analysis - VulDB reports the vendor was contacted but did not respond, and no fix version or commit appears in the supplied references. As a compensating control, operators should replace pickle.load/pickle.loads in selfdrive/modeld/modeld.py with a safe serialization format (e.g., load model weights via numpy.load with allow_pickle=False, safetensors, or ONNX) so that untrusted byte streams cannot trigger __reduce__ gadgets; this requires regenerating any pickled artifacts the daemon currently consumes. Until the loader is changed, restrict who can write to the model and cache paths that modeld reads from (filesystem permissions, read-only mounts, verified-boot or dm-verity on the comma device image) and avoid running Openpilot images or model files from untrusted third parties, accepting that this breaks community model-swapping workflows. Monitor https://vuldb.com/vuln/370837 and the Openpilot GitHub repository for an upstream fix.