CVE-2026-69098

CVE-2026-69098 in kotaemon rates CVSS 9.8 (unauthenticated RCE via insecure deserialization) but carries an EPSS score of just 0.00508 — roughly one-twentieth what the severity rating would predict. That gap is analytically significant, not noise. The vulnerability exploits the `__type__` field pattern in polymorphic deserialization, likely in how kotaemon tests connections across multiple backend services (Ollama, OpenAI, vLLM, etc.). The key constraint the EPSS is capturing: successful exploitation requires knowing which backends are actually configured on the target. However — and this is the critical detail — the `/api/connection` endpoint itself serves as an enumeration surface. An attacker can query it without authentication in default deployments to discover what backends exist before crafting type-tagged payloads. This two-step approach (enumerate, then inject) lowers the knowledge barrier the CVSS-EPSS gap initially suggests. For defenders, the most important question is the fix's shape in version 0.12.0. If the patch applied surgical input validation — a blacklist or even allowlist on `__type__` values — expect a follow-up CVE within six months; type conflation bypasses are well-documented against this pattern. If the fix is architectural — removing polymorphic deserialization entirely and replacing it with explicit type dispatch — this represents a durable correction rather than a localized patch. The blast radius matters here too. kotaemon is a document Q&A system indexing proprietary, classified, or otherwise sensitive corpora. RCE as the application user means access to everything the system knows. The EPSS models opportunistic mass-exploitation probability, but this is exactly the class of target a sophisticated adversary (nation-state, corporate espionage) would prioritize — the value concentration is extreme even if the exploit probability is low.

Reviewed through automated stages and approved by a human before publication.