CRITICAL 9.3 NVD
CVE-2026-69098
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with application process privileges.
References
- https://github.com/Cinnamon/kotaemon/issues/844
- https://www.vulncheck.com/advisories/kotaemon-unauthenticated-remote-code-execution-via-in
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-08-04 via NVD.
Risk Timeline
CVE Disclosed2026-08-04 · -1 days ago
Remediation Resources
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.