CVE-2026-29198

CVE-2026-29198 is a NoSQL injection vulnerability affecting multiple versions of Rocket.Chat prior to version 8.3.0 and various earlier release branches (8.2.1, 8.1.2, 8.0.3, 7.13.5, 7.12.6, 7.11.6, and 7.10.9). When an OAuth application is configured, this vulnerability can be exploited to achieve account takeover of the first user with a generated token, potentially compromising administrative access. The attack appears to have low complexity and network accessibility, though the exact CVSS metrics are not available in the current vulnerability data. The potential impact is severe, as successful exploitation grants attackers control over a privileged account, enabling them to access sensitive communications and potentially escalate privileges within the Rocket.Chat deployment. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.00014 indicates minimal current exploitation likelihood. Organizations using affected Rocket.Chat versions should prioritize patching to mitigate this account takeover risk, particularly in deployments with OAuth authentication configured.