CVE-2026-69098

Summary

The flaw allows unauthenticated attackers to execute arbitrary code by exploiting an insecure deserialization vulnerability in the check_connection endpoint, leading to remote code execution with application process privileges.

Exploitability

Exploitation is relatively straightforward given the unauthenticated nature and the ability to override the __type__ field with subprocess.check_output, requiring only crafted YAML/JSON input.

Blast radius

If exploited, the impact could be severe, as it allows for remote code execution with the privileges of the application process, potentially leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.12.1 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.