CVE-2026-69098: kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization
kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the checkconnection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a type field. Attackers can exploit this to override the type field with subprocess.checkoutput and arbitrary arguments, achieving remote code execution with application process privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69098?
The severity of CVE-2026-69098 is critical with a score of 9.8.
What type of vulnerability is CVE-2026-69098?
CVE-2026-69098 is an unauthenticated remote code execution vulnerability due to insecure deserialization.
How do I fix CVE-2026-69098?
To fix CVE-2026-69098, upgrade to a patched version of kotaemon that addresses the insecure deserialization issue.
What systems are affected by CVE-2026-69098?
CVE-2026-69098 affects kotaemon versions up to 0.12.0.
Can CVE-2026-69098 be exploited remotely?
Yes, CVE-2026-69098 can be exploited remotely by unauthenticated attackers.