Which versions of kotaemon are affected by CVE-2026-69098?

kotaemon (Cinnamon) versions through 0.12.0 contain a critical remote code execution vulnerability in the check_connection endpoint that allows unauthenticated attackers to execute arbitrary OS…

Is there a public PoC exploit available for CVE-2026-69098?

Yes, a public proof-of-concept exploit is available for CVE-2026-69098. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-69098?

Within 24 hours, identify all systems running kotaemon through version 0.12.0, particularly any internet-facing or network-accessible deployments, and verify whether they run the check_connection endpoint. Within 7 days, implement compensating controls: restrict or disable network access to the check_connection endpoint using firewall rules or a web application firewall (WAF), apply input validation to reject requests containing __type__ or subprocess class references, isolate affected systems to restricted network segments, and implement logging and alerting for suspicious deserialization attempts. Within 30 days, monitor the kotaemon project repository and vendor advisories daily for patch availability; if no patch is released, evaluate alternative packages or plan controlled migration to unaffected versions, and conduct a security assessment to detect any exploitation attempts.

kotaemon CVE-2026-69098

Q: What is the CVSS score of CVE-2026-69098?

CVE-2026-69098 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-52740 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-04 VulnCheck

GHSA-5cg2-9v3x-66cv

RCE Python Deserialization Kotaemon Cinnamon

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable endpoint with low-complexity deserialization yields PR:N/AC:L/AV:N; RCE gives full C/I/A on the app host with no cross-system scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 16:06 vuln.today

CVE Published

Aug 04, 2026 - 15:15 cve.org

CRITICAL 9.3

DescriptionCVE.org

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with application process privileges.

Articles & Coverage 1

News Critical RCE in kotaemon (Cinnamon) via Insecure Deserialization - CVE-2026-69098 Aug 04, 2026

AnalysisAI

Remote code execution in kotaemon (Cinnamon) versions through 0.12.0 allows unauthenticated attackers to run arbitrary commands via the check_connection endpoint, which insecurely deserializes attacker-supplied YAML/JSON. By setting the __type__ field to subprocess.check_output with chosen arguments, an attacker instantiates arbitrary Python objects and executes OS commands with the application's process privileges. Publicly available exploit code exists (VulnCheck advisory and upstream issue), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as actively exploited.

Technical ContextAI

kotaemon is an open-source RAG (retrieval-augmented generation) application/UI for building document question-answering systems over LLMs, written in Python. The root cause is CWE-502 (Deserialization of Untrusted Data): the check_connection endpoint reconstructs Python objects from user-controlled structured input by honoring a __type__ discriminator field, effectively using it as a dynamic class/callable dispatch. Because the type is not restricted to a safe allowlist, an attacker can name any importable callable - here subprocess.check_output - turning object hydration into arbitrary code execution. Per the CPE data, the affected product is cpe:2.3:a:cinnamon:kotaemon across all versions up to and including 0.12.0.

RemediationAI

No vendor-released patched version is identified in the provided data (upstream tracking exists at https://github.com/Cinnamon/kotaemon/issues/844); monitor that issue and the project repository for a fixed release beyond 0.12.0 and upgrade as soon as one is published. As immediate compensating controls, restrict network access to the kotaemon application so the check_connection endpoint is not reachable by untrusted clients - place it behind an authenticating reverse proxy or VPN and block direct internet exposure (trade-off: breaks any intended anonymous access). Where feasible, disable or firewall the check_connection endpoint specifically until a patch is available (trade-off: connection-testing functionality is lost), and run the application under a low-privilege, sandboxed service account to limit the blast radius of any RCE. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/kotaemon-unauthenticated-remote-code-execution-via-insecure-deserialization) for authoritative guidance.