CVE-2026-12191: Comma AI Openpilot Deserialization Flaw

CVE-2026-12191 Overview

CVE-2026-12191 is an insecure deserialization vulnerability in Comma AI Openpilot 0.11. The flaw resides in the pickle.load and pickle.loads calls within selfdrive/modeld/modeld.py, part of the Pickle Module component. An attacker with local access can supply crafted serialized data that triggers unsafe deserialization, leading to arbitrary code execution in the context of the driving model process. The vendor was contacted before public disclosure but did not respond. The weakness is classified under [CWE-20] Improper Input Validation.

Critical Impact
Local attackers can execute arbitrary Python code within the Openpilot driving stack by supplying malicious pickle data to modeld.py, compromising confidentiality, integrity, and availability of the driving model runtime.

Affected Products

Comma AI Openpilot 0.11
Component: Pickle Module (selfdrive/modeld/modeld.py)
Functions: pickle.load / pickle.loads

Discovery Timeline

2026-06-14 - CVE-2026-12191 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database
2026-06-18 - Exploit Prediction Scoring System (EPSS) data recorded

Technical Details for CVE-2026-12191

Vulnerability Analysis

The vulnerability exists because selfdrive/modeld/modeld.py calls Python's pickle.load or pickle.loads on data that is not cryptographically authenticated. Python's pickle format allows serialized objects to embed arbitrary callables through the __reduce__ mechanism. When such an object is deserialized, the embedded callable executes with the privileges of the loading process. This pattern is unsafe for any data that an untrusted party can influence.

In Openpilot, modeld loads model assets and runtime state during the driving stack initialization. A local attacker who can write to a path the deserializer reads from, or otherwise influence the input stream, can trigger code execution inside the driving model process. The Common Weakness Enumeration mapping ([CWE-20]) reflects the absence of validation before deserialization.

Root Cause

The root cause is the use of an unsafe serialization format for input data. pickle.load and pickle.loads are documented by Python as unsuitable for untrusted input. The modeld.py code path treats pickle data as trusted without integrity checks such as signed manifests or restricted unpickling via a custom find_class allowlist.

Attack Vector

Exploitation requires local access and low privileges. The attacker plants or modifies a pickle artifact that modeld.py consumes. On the next load, the deserializer instantiates attacker-controlled objects and executes embedded code. No user interaction is required. The vulnerability does not cross a process or trust boundary remotely, which limits the attack surface to operators with local foothold on the device running Openpilot.

No public proof-of-concept code has been published for CVE-2026-12191. Technical details are tracked in the VulDB CVE-2026-12191 entry and VulDB Vulnerability #370837.

Detection Methods for CVE-2026-12191

Indicators of Compromise

Unexpected modification timestamps on pickle files loaded by selfdrive/modeld/modeld.py
Spawning of shell interpreters, network utilities, or Python subprocesses from the modeld process
Outbound network connections initiated by modeld to unfamiliar hosts shortly after startup

Detection Strategies

Hash and inventory all pickle artifacts consumed by modeld.py, and alert on changes that do not match approved releases
Instrument the Python runtime with a restricted unpickler that logs any class load outside an explicit allowlist
Use endpoint behavioral monitoring to flag child processes or syscalls that the modeld process does not legitimately perform

Monitoring Recommendations

Centralize Openpilot device logs and search for pickle-related exceptions or unusual import activity at model load time
Monitor filesystem write events targeting model and state directories used by modeld
Track integrity of the Openpilot installation directory with file integrity monitoring (FIM)

How to Mitigate CVE-2026-12191

Immediate Actions Required

Restrict local access to devices running Comma AI Openpilot 0.11 to trusted operators only
Treat all pickle artifacts as sensitive and protect their storage paths with strict filesystem permissions
Audit the selfdrive/modeld/modeld.py load paths and remove any pickle inputs that originate from writable or shared locations

Patch Information

No vendor patch has been published at the time of writing. The vendor did not respond to disclosure outreach according to the VulDB advisory. Track the upstream Openpilot project for updates and apply releases that replace pickle with a safer serialization format such as JSON, Protocol Buffers, or a signed model container.

Workarounds

Replace pickle.load/pickle.loads usage in modeld.py with a restricted unpickler that overrides find_class to allow only required model classes
Verify integrity of pickle inputs with a cryptographic signature (for example HMAC-SHA256) before deserialization
Run the modeld process under a dedicated low-privilege account with mandatory access control profiles (AppArmor or SELinux) to contain potential code execution

bash

# Example: enforce read-only model directory and integrity check before load
sudo chown -R root:openpilot /data/openpilot/selfdrive/modeld/models
sudo chmod -R 0750 /data/openpilot/selfdrive/modeld/models

# Verify a signed manifest before starting modeld
sha256sum -c /data/openpilot/selfdrive/modeld/models/manifest.sha256 \
  && systemctl start openpilot-modeld