Which versions of ChromaDB are affected by CVE-2026-45830?

ChromaDB versions 0.4.17 and later contain a critical tenant isolation flaw that allows authenticated users to access, modify, or delete data belonging to other customers in multi-tenant deployments.

How to fix or mitigate CVE-2026-45830?

Within 24 hours: Determine if ChromaDB version 0.4.17 or later is deployed in multi-tenant production. Within 7 days: If multi-tenant, implement network isolation by segregating each tenant into a dedicated ChromaDB instance or implement strict application-layer access controls to prevent cross-tenant queries. Within 30 days: Monitor ChromaDB release channels for security patches and plan immediate upgrade upon availability.

ChromaDB CVE-2026-45830

Q: What is the CVSS score of CVE-2026-45830?

CVE-2026-45830 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36461 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-12 HiddenLayer

GHSA-2wm9-hf6c-p5cr

Python Authentication Bypass Chromadb

8.8

CVSS 4.0 · Vendor: HiddenLayer

Severity by source

Vendor (HiddenLayer) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Network API with any valid low-privileged tenant credential (PR:L), no user interaction, scope changes to other tenants (S:C) with high C/I impact on their data; availability not affected.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (HiddenLayer).

CVSS VectorVendor: HiddenLayer

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 16:18 vuln.today

DescriptionCVE.org

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

Articles & Coverage 1

News 5 New Python Vulnerabilities - 1 Critical, 4 High Severity Jun 13, 2026

AnalysisAI

Cross-tenant data access in ChromaDB Python project version 0.4.17 and later allows any authenticated user to read, write, update, or delete data in collections belonging to other tenants, breaking the tenant isolation boundary that multi-tenant deployments rely on. The flaw, reported by HiddenLayer and tracked under CWE-639, carries a CVSS 4.0 score of 8.8 reflecting high confidentiality and integrity impact on both the vulnerable system and downstream tenants. No public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

ChromaDB is an open-source AI-native embedding database written in Python, widely used as the vector store backing retrieval-augmented generation (RAG) pipelines and LLM memory layers. It exposes a multi-tenant data model where logical 'tenants' are intended to isolate collections of embeddings between customers or applications. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the server treats the tenant or collection identifier supplied by the caller as the access-control decision, without separately verifying that the authenticated principal is actually entitled to act on that tenant. The CPE cpe:2.3:a:chroma:chromadb:*:*:*:*:*:*:*:* indicates all Python ChromaDB builds from 0.4.17 onward are in scope until a fixed release is published.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data - consult the HiddenLayer advisory at https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb and the Chroma project release notes for the fixed version once published, then upgrade ChromaDB Python to that release. Until a fixed version is available, restrict the ChromaDB API to a single trust boundary per instance: run one ChromaDB process per tenant (network-isolated or container-isolated) so cross-tenant access is structurally impossible, accepting the operational overhead of more processes and higher resource use. As a second compensating control, place an authenticating reverse proxy in front of ChromaDB that rewrites or validates the tenant/collection identifier in each request against the authenticated principal, rejecting any request whose tenant scope does not match the token's claims - this preserves multi-tenancy but adds a proxy hop and requires per-deployment policy code. Avoid simply disabling authentication, since that worsens rather than mitigates the exposure.