Which versions of ChromaDB are affected by CVE-2026-45832?

ChromaDB's Python implementation contains an authorization bypass vulnerability (CVSS 8.8) affecting the V1 REST API, allowing authenticated tenants to read and write data outside their authorization…

How to fix or mitigate CVE-2026-45832?

Within 24 hours: inventory all ChromaDB Python deployments and identify those running in multi-tenant mode; assess network exposure and data sensitivity. Within 7 days: implement network-level access controls restricting V1 REST API endpoints to trusted clients; disable multi-tenant feature if operationally feasible; enable comprehensive audit logging on collection access. Within 30 days: upgrade to patched version once ChromaDB releases a fix; conduct forensic review of audit logs for unauthorized cross-tenant access during the vulnerability window.

ChromaDB CVE-2026-45832

Q: What is the CVSS score of CVE-2026-45832?

CVE-2026-45832 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36483 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-12 HiddenLayer

GHSA-x97m-f58v-9cwg

Python Authentication Bypass Chromadb

8.8

CVSS 4.0 · Vendor: HiddenLayer

Severity by source

Vendor (HiddenLayer) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Remote API call with valid low-priv credentials (PR:L), no UI, scope-changed because authz boundary across tenants is broken; high C/I on other tenants' data, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (HiddenLayer).

CVSS VectorVendor: HiddenLayer

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 16:27 vuln.today

DescriptionCVE.org

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

Articles & Coverage 1

News 5 New Python Vulnerabilities - 1 Critical, 4 High Severity Jun 13, 2026

AnalysisAI

Authorization bypass in ChromaDB's Python implementation lets authenticated tenants reach data outside their authorization boundary by invoking the V1 collection-level REST endpoints, which forward None as both the tenant and database identifiers to the authorization layer. The flaw, disclosed by HiddenLayer, exposes high-impact reads and writes to cross-tenant collections in this Python vector database. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.

Technical ContextAI

ChromaDB is an open-source Python vector database widely used as the embedding/retrieval store behind LLM and RAG pipelines, exposing a multi-tenant REST API with both legacy V1 and newer V2 collection endpoints. The CWE-639 (Authorization Bypass Through User-Controlled Key) root cause is structural: V1 collection-level handlers in the Python codebase never populate the tenant and database arguments that the authorization layer expects, instead passing literal None values. The authorization check is therefore evaluated against a null tenant/database tuple rather than the caller's real scope, so any user who can authenticate at all is treated as if they had no tenant boundary. CPE cpe:2.3:a:chroma:chromadb:*:*:*:*:*:*:*:* indicates the issue affects the chromadb product across unspecified versions until a fixed release is identified.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data, so confirm the fixed ChromaDB release via the HiddenLayer advisory at https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-4 and Chroma's GitHub releases before scheduling the upgrade. As a compensating control until patched, block or proxy-strip requests to the legacy V1 collection routes (e.g., /api/v1/collections and related collection-scoped paths) at the ingress or reverse proxy and force clients onto V2 endpoints, which avoids the None-tenant code path entirely; the trade-off is breaking any consumer still pinned to the V1 client. Where V1 must remain reachable, restrict network exposure to a single trusted tenant only and disable shared multi-tenant configurations, accepting that cross-tenant features will be unavailable. Audit logs for V1 collection calls that succeeded with cross-tenant identifiers to detect prior abuse.