10.0
Critical
CVE-2026-45829 A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an…
Description
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ChromaDB 1.0 | 1.0.0 → latest | No fix stated |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published |
References
- www.hiddenlayer.com www.hiddenlayer.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of ChromaDB
The 6 CVEs of ChromaDB →
CVE-2026-45833
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated…
9.4
Critical
CVE-2026-45832
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the…
8.8
High
CVE-2026-45831
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project…
8.8
High
CVE-2026-8828
A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users…
8.8
High