CVE-2026-45829 — Vulnerability in chromadb — CVE Details
CRITICAL
ChromaDB Python project has a pre-authentication code injection vulnerability
Published May 18, 2026Updated October 5, 2026Source: osv
Summary
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
Advisory Timeline
- First published May 18, 2026 (147 days ago).
- Last revised October 5, 2026 — 140 days after initial publication.
Affected Packages (1)
Affects 1 ecosystem: pypi (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| chromadb | pypi | 1.0.0, 1.0.10, 1.0.11, 1.0.12 (+40 more) | Range-based data available |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 10.0 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-45829ADVISORY
- https://github.com/chroma-core/chroma/issues/6717WEB
- https://access.redhat.com/security/cve/CVE-2026-45829WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2479623WEB
- https://github.com/advisories/GHSA-f4j7-r4q5-qw2cADVISORY
- https://github.com/chroma-core/chromaPACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/chromadb/PYSEC-2026-311.yamlWEB
- https://pypi.org/project/chromadbWEB
- https://www.hiddenlayer.com/research/chromatoast-served-pre-authWEB
Frequently Asked Questions
- What is CVE-2026-45829?
- ChromaDB Python project has a pre-authentication code injection vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 10.0/10).
- How do I check if my project is affected by CVE-2026-45829?
- CVE-2026-45829 affects chromadb. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-45829 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
10.0
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-f4j7-r4q5-qw2c
PYSEC-2026-311
Related CVEs
- CVE-2026-45833CRITICAL
ChromaDB has a code injection vulnerability
- CVE-2026-61447CRITICAL
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
- CVE-2026-45833CRITICAL
ChromaDB has a code injection vulnerability
- CVE-2026-61445CRITICAL
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies