Which versions of ChromaDB are affected by CVE-2026-45829?

ChromaDB Python versions 1.0.0 and later contain a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary commands on affected servers via the…

How to fix or mitigate CVE-2026-45829?

Within 24 hours: Inventory all ChromaDB Python deployments (1.0.0+) and assess external accessibility of the /api/v2/tenants endpoint. Within 7 days: Immediately disable the trust_remote_code parameter in ChromaDB configuration and implement network-level restrictions limiting collection endpoint access to authorized internal systems only. Within 30 days: Monitor HiddenLayer and ChromaDB advisory channels for a vendor-released patch and deploy immediately upon availability; evaluate alternative vector database solutions if patch timeline is uncertain.

ChromaDB CVE-2026-45829

Q: What is the CVSS score of CVE-2026-45829?

CVE-2026-45829 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-30779 CRITICAL

Code Injection (CWE-94)

2026-05-18 HiddenLayer

GHSA-f4j7-r4q5-qw2c

RCE Code Injection Python Chromadb

10.0

CVSS 4.0 · Vendor: HiddenLayer

Severity by source

Vendor (HiddenLayer) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

10.0 CRITICAL

qualitative

Primary rating from Vendor (HiddenLayer).

CVSS VectorVendor: HiddenLayer

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 17:30 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on chromadb (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.0.0.

DescriptionCVE.org

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

AnalysisAI

Remote code execution in ChromaDB Python (version 1.0.0 and later) allows unauthenticated attackers to execute arbitrary code on the server by submitting a malicious model repository with trust_remote_code enabled via the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint. The flaw carries a maximum CVSS 4.0 score of 10.0 and was disclosed publicly by HiddenLayer; no public exploit identified at time of analysis, though detailed research has been published.

Technical ContextAI

ChromaDB is a popular open-source AI-native embedding database written in Python, commonly deployed as a vector store backing retrieval-augmented generation (RAG) pipelines and LLM applications. The vulnerability is a CWE-94 Improper Control of Generation of Code ('Code Injection') flaw in the collections REST API (/api/v2/tenants/{tenant}/databases/{db}/collections), where supplying a crafted model repository together with the trust_remote_code=true parameter causes ChromaDB to load and execute attacker-controlled Python from the referenced repository. This pattern mirrors known risks with Hugging Face transformers' trust_remote_code option, which downloads and runs arbitrary model code: ChromaDB exposes this dangerous capability over an unauthenticated network API, turning a library-level footgun into a remote primitive. The affected CPE is cpe:2.3:a:chroma:chromadb covering all 1.0.0 and later releases per the EUVD record.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data, so operators should immediately monitor the upstream tracking issue at https://github.com/chroma-core/chroma/issues/6717 and the HiddenLayer advisory at https://www.hiddenlayer.com/research/chromatoast-served-pre-auth for a fixed release and upgrade ChromaDB to that patched version as soon as it is published. Until a patch is available, restrict network access to the ChromaDB API so the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint is not reachable from untrusted networks (firewall or service-mesh policies), place an authenticating reverse proxy in front of ChromaDB to eliminate the pre-auth attack surface, and where feasible reject or filter requests that include trust_remote_code=true or reference external model repositories at the proxy layer - note that filtering may break legitimate workflows that intentionally load remote model code. Additionally, run ChromaDB under a least-privileged service account in a network-segmented or container-isolated environment so that successful code execution does not yield broader host or cluster compromise.