CVE-2026-45829

CVSS 10 CRITICALEPSS 10.3%CWE-94

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected products

Chroma · ChromaDB

public PoCs found — 2

githubgithub.com/fevar54/FULL-ANALYSIS---CVE-2026-45829-ChromaDB-★ 0 githubgithub.com/0xBlackash/CVE-2026-45829★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/chroma-core/chroma/issues/6717 https://www.hiddenlayer.com/research/chromatoast-served-pre-auth