EUVD-2026-36461
GHSA-2wm9-hf6c-p5cr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API with any valid low-privileged tenant credential (PR:L), no user interaction, scope changes to other tenants (S:C) with high C/I impact on their data; availability not affected.
Primary rating from Vendor (HiddenLayer).
CVSS VectorVendor: HiddenLayer
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.
Articles & Coverage 1
AnalysisAI
Cross-tenant data access in ChromaDB Python project version 0.4.17 and later allows any authenticated user to read, write, update, or delete data in collections belonging to other tenants, breaking the tenant isolation boundary that multi-tenant deployments rely on. The flaw, reported by HiddenLayer and tracked under CWE-639, carries a CVSS 4.0 score of 8.8 reflecting high confidentiality and integrity impact on both the vulnerable system and downstream tenants. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid low-privileged authenticated session on a ChromaDB Python instance running version 0.4.17 or later that is deployed in multi-tenant mode with more than one tenant configured - the attacker must know or guess the target tenant or collection identifier, but no admin role, user interaction, or special client is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N consistently describes a network-reachable, low-complexity bug that requires only a valid low-privileged credential and no user interaction, with high confidentiality and integrity impact on both the vulnerable server and subsequent tenant systems - availability is unaffected because the bug enables data manipulation rather than crashes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a low-privileged account on a multi-tenant ChromaDB-backed RAG or AI agent platform, authenticates to the ChromaDB API, then issues read or write API calls naming a collection or tenant identifier belonging to a different customer. Because authorization is not validated against the caller's tenant, the server returns the victim tenant's embeddings (often raw document chunks containing proprietary text) and accepts destructive writes or deletes, enabling data theft, prompt-injection seeding, or denial-of-service against the victim tenant's AI features. |
| Remediation | No vendor-released patch identified at time of analysis from the provided data - consult the HiddenLayer advisory at https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb and the Chroma project release notes for the fixed version once published, then upgrade ChromaDB Python to that release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Determine if ChromaDB version 0.4.17 or later is deployed in multi-tenant production. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated remote attackers can invoke MCP tool handlers and exfiltrate the operator's long-lived Meta Graph API ac
Authenticated remote code execution in ChromaDB Python project versions 0.4.17 and later enables attackers holding the U
Authentication bypass in dhax/go-base Go REST API boilerplate (versions prior to commit cc82b974, merged May 17, 2026) a
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Remote code execution in Splunk Enterprise, Splunk Cloud Platform, and the Splunk Secure Gateway app allows a low-privil
Share
External POC / Exploit Code
Leaving vuln.today