CVE-2026-12191: Openpilot 0.11 Unsafe Pickle Deserialization – LOCAL RCE

Technical summary

CVE-2026-12191 is a deserialization vulnerability in the pickle module handling of Openpilot's modeld.py component. The vulnerability stems from unsafe use of pickle.load() and pickle.loads() functions, which deserialize untrusted data without validation. Pickle is inherently unsafe for untrusted input because it can instantiate arbitrary Python objects during deserialization. An attacker with local access and low privileges can craft a malicious serialized object and cause it to be loaded by the modeld process, resulting in remote code execution. The issue is classified under CWE-502 (Deserialization of Untrusted Data) and CWE-20 (Improper Input Validation).

Business impact

For organizations deploying Openpilot in autonomous vehicle fleets or testing environments, this vulnerability poses a direct threat to vehicle safety and operational security. A compromised model loading process could alter perception models, inject malicious driving commands, or exfiltrate sensor data and proprietary machine learning models. In a fleet context, an attacker gaining local access to a single vehicle could potentially compromise the vehicle's decision-making logic. Additionally, this vulnerability may impact any organization relying on Openpilot for research or development, as insider threats or compromised development machines become viable attack vectors.

Affected systems

This vulnerability specifically affects Comma AI Openpilot version 0.11. The affected component is the pickle-based model deserialization in selfdrive/modeld/modeld.py. Any deployment, testing, or development instance of Openpilot 0.11 is at risk. Organizations should inventory all systems running this version, including development machines, test vehicles, and production fleets. Later versions of Openpilot should be evaluated to determine if they have addressed this vulnerability, though this CVE record does not provide explicit patch version information.

Exploitability

Exploitation requires local system access and the ability to place or influence a malicious pickle file in a location where the modeld component will load it. The CVSS score of 7.8 (HIGH) reflects both the severity of impact and the relatively straightforward nature of the attack once local access is obtained. The attack does not require user interaction, elevated privileges, or network access—only the ability to write files or manipulate the environment where Openpilot processes model data. In a shared development environment or on a vehicle with multiple users or processes, this becomes a realistic threat.

Remediation

Organizations must upgrade from Openpilot 0.11 to a patched version. Verify the latest available version through the official Comma AI repository and release notes to confirm that deserialization handling has been remediated. Until patching is possible, mitigations include restricting local access to systems running Openpilot, enforcing file integrity monitoring on model data directories, disabling or isolating the modeld component if not in active use, and running Openpilot with minimal privileges. Code review of pickle usage should prioritize replacing pickle.load/loads with safer serialization formats such as JSON, MessagePack, or Protocol Buffers.

Patch guidance

Contact Comma AI through their official channels or monitor their GitHub repository for security advisories and patched releases. Verify the specific version number that addresses this issue before deploying updates. If Openpilot is running in a production fleet, plan a staged rollout to validate compatibility and vehicle behavior after patching. Given that the vendor did not respond to early disclosure, monitor third-party security disclosures and community forums for workarounds or unofficial patches. Document the current version running in your environment and establish a process to track future updates.

Detection guidance

Monitor for suspicious pickle file creation or modification in directories accessed by the modeld process, particularly in model cache or data loading paths. Implement file integrity checking on model files to detect unauthorized changes. Log and alert on any unexpected child process spawning from the modeld service, which could indicate code execution via deserialization. If logs are available, check for exceptions or errors in pickle deserialization that might indicate an attacker's failed attempts. In fleet deployments, monitor vehicle telemetry for anomalous model outputs or unexpected behavior changes that could indicate model corruption.

Why prioritize this

Despite the local-access-only requirement, this vulnerability warrants prompt attention due to its HIGH severity rating and the critical nature of autonomous driving systems. A compromised model loading mechanism directly threatens vehicle safety and could enable attacks on multiple vehicles if a fleet shares development infrastructure. The fact that the vendor has not responded to disclosure adds urgency—patches may be delayed or unavailable, necessitating rapid internal mitigation. Organizations should prioritize this above many network-based vulnerabilities because the impact scope (vehicle behavior, safety systems, proprietary models) is more consequential.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects an attack vector limited to local access (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction needed (UI:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately elevates the risk due to the unrestricted impact potential—once code execution is achieved, an attacker has near-complete control over the model loading process and downstream vehicle behavior. The unchanged scope (S:U) indicates the impact does not extend beyond the vulnerable component, but given that component's critical role in autonomous driving, the practical risk is substantial.

Frequently asked questions