10.0
Critique
CVE-2026-45829 A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an…
Description
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| ChromaDB 1.0 | 1.0.0 → dernières | Pas de correctif indiqué |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions non publiées |
Références
- www.hiddenlayer.com www.hiddenlayer.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de ChromaDB
Les 6 CVE de ChromaDB →
CVE-2026-45833
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated…
9.4
Critique
CVE-2026-45832
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the…
8.8
Élevée
CVE-2026-45831
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project…
8.8
Élevée
CVE-2026-8828
A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users…
8.8
Élevée