Kotaemon vulnerabilities

2 known vulnerabilities in Kotaemon from Cinnamon. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  kotaemon: Authorization Bypass Through User-Controlled Key

  CVE-2026-82281Aug 28, 2026Cinnamon

  Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversa

• 9.8 Critical severity

  kotaemon: Deserialization of Untrusted Data

  CVE-2026-69098Aug 4, 2026Cinnamon

  kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can