Unauthenticated Remote Code Execution in kotaemon

Cinnamon kotaemon versions through 0.12.0 contain a critical insecure deserialization vulnerability identified as CVE-2026-69098. The vulnerability exists within the application's 'check_connection' endpoint, which fails to properly sanitize user-supplied input when deserializing YAML or JSON data. By crafting a specific payload containing a 'type' field, an unauthenticated remote attacker can instruct the application to instantiate arbitrary Python classes.

The exploit allows an attacker to manipulate this type-instantiation mechanism to trigger 'subprocess.check_output' with attacker-supplied arguments. This results in the execution of arbitrary commands with the privileges of the underlying application process. Because the endpoint does not require authentication, the attack vector is highly accessible to any network actor capable of reaching the service. Given the ease of exploitation and the severity of achieving remote code execution, this vulnerability poses a significant risk to any environment hosting kotaemon.

Impact

Successful exploitation results in full remote code execution on the server running the kotaemon application. An attacker can execute arbitrary OS commands with the permissions of the user running the application process, potentially leading to total system compromise, data exfiltration, or lateral movement within the network.

Recommendation

• Upgrade the kotaemon application to a version beyond 0.12.0 immediately to mitigate CVE-2026-69098.
• Implement network-level access control to restrict access to the 'check_connection' endpoint to authorized users or internal network segments only.
• Audit application logs for suspicious POST requests directed at the '/check_connection' URI that contain unexpected JSON/YAML structures, particularly those utilizing 'type' fields or shell-related commands.
• Deploy webserver logging to monitor for unauthorized traffic patterns interacting with API endpoints.