A critical (CVSS 9.8) insecure deserialization flaw in kotaemon through version 0.12.0 lets unauthenticated attackers execute arbitrary code on the host by abusing a __type__ field in the check_connection endpoint.
What Is It
CVE-2026-69098 is an insecure deserialization vulnerability (CWE-502) in Cinnamon's kotaemon. The check_connection endpoint accepts YAML/JSON input containing a __type__ field and uses it to instantiate arbitrary Python classes. An attacker can override __type__ with subprocess.check_output and supply arbitrary arguments, turning the deserialization path into direct command execution.
The result is remote code execution running with the privileges of the application process. No authentication is required.
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS 4.0 score of 9.3 (CRITICAL) is also published by the reporting source.
Every factor that makes a bug easy to exploit is present here: network attack vector, low attack complexity, no privileges required, and no user interaction. Confidentiality, integrity, and availability impacts are all rated HIGH. An exposed kotaemon instance is a single unauthenticated HTTP request away from arbitrary command execution.
There is no CISA KEV entry for this CVE in the supplied source material, so no confirmed active exploitation and no federal remediation deadline are recorded at this time.
What's Vulnerable
- Vendor: Cinnamon
- Product: kotaemon
- Affected versions: all versions up to and including 0.12.0 (
<= 0.12.0, semver) - Repository: https://github.com/Cinnamon/kotaemon
- Package URL:
pkg:github/Cinnamon/kotaemon
The vulnerable component is the check_connection endpoint.
Patch Status
The supplied NVD record does not name a fixed version or patch. The CVE was published 2026-08-04 with a vulnerability status of Received, meaning NVD analysis is not yet complete. No required action or remediation date is specified in the source material.
Operators should track the upstream issue and the VulnCheck advisory below for fix availability, and treat internet-exposed kotaemon deployments at or below 0.12.0 as at risk in the interim.
Sources
- NVD, CVE-2026-69098: https://nvd.nist.gov/vuln/detail/CVE-2026-69098
- VulnCheck Advisory; kotaemon unauthenticated remote code execution via insecure deserialization: https://www.vulncheck.com/advisories/kotaemon-unauthenticated-remote-code-execution-via-insecure-deserialization
- Cinnamon/kotaemon GitHub Issue #844: https://github.com/Cinnamon/kotaemon/issues/844