CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-69098 — kotaemon through 0.12.0 contains an insecure deserialization vulnerability in th...

·Source: NIST NVD

Updated:

Executive Summary

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with appli

Analysis

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with application process privileges. CVSS Score: 9.8. Published: 2026-08-04T16:16:28.190.

Indicators of Compromise (1)

CVE (1)
CVE-2026-69098
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 4, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

FNZ offloads German bank to focus on wealthtech business

Wealth management platform FNZ has agreed to sell its German FNZ Bank business to Advent and a consortium including HarbourVest Partners. Financial terms were not disclosed.

Finextra
LOWVulnerability

CVE-2026-18830 - Issue with Amazon Bedrock AgentCore harness – Insufficient Input Validation

<p><b>Bulletin ID:</b> 2026-073-AWS<br> <b>Scope:</b> AWS<br> <b>Content Type:</b> Important (requires attention)<br> <b>Publication Date:</b> 08/04/2026 10:00 AM PDT</p> <p><b>Description:</b></p> <p>We have identified CVE-2026-18830 in the Amazon Bedrock AgentCore harness InvokeHarness API. This issue could allow an authenticated user to execute configured tools while bypassing model invocation

CVE-2026-18830
AWS Security Bulletins
CRITICALVulnerability

Privacy Concerns Raised Over Government Demand for Hospital Emergency Room Data

The United States Consumer Product Safety Commission (CPSC) is requesting digital patient data from hospitals as part of its efforts [&#8230;] The post Privacy Concerns Raised Over Government Demand for Hospital Emergency Room Data appeared first on The HIPAA Journal .

HIPAA Journal