CVE-2026-45829

Summary

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

Affected Software

Weaknesses

• CWE-94: CWE-94: Improper Control of Generation of Code ('Code Injection')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: total

Additional References

• https://www.hiddenlayer.com/research/chromatoast-served-pre-auth

chromadb: ChromaDB Python Project: Arbitrary code execution via pre-authentication code injection

Additional References

• https://access.redhat.com/security/cve/CVE-2026-45829
• https://bugzilla.redhat.com/show_bug.cgi?id=2479623
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45829.json

References

• https://www.hiddenlayer.com/research/chromatoast-served-pre-auth
• https://github.com/chroma-core/chroma/issues/6717

• ←Previous
• Next→