EUVD-2026-36464
GHSA-843m-rfxf-6v2g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR exploitable by any low-privileged authenticated user; scope changes because impact lands on other tenants, yielding high C and I but no availability effect.
Primary rating from Vendor (HiddenLayer).
CVSS VectorVendor: HiddenLayer
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.
AnalysisAI
Cross-tenant data access in the ChromaDB Rust implementation (version 1.0.0 and later) lets any authenticated tenant user read, write, update, or delete data inside collections owned by other tenants because the server does not validate that the caller's tenant matches the target resource. The flaw, reported by HiddenLayer and tracked as CWE-639, breaks the tenant isolation boundary that multi-tenant ChromaDB deployments rely on, and no public exploit identified at time of analysis.
Technical ContextAI
ChromaDB is an open-source vector database commonly used to store embeddings for retrieval-augmented generation (RAG) and other AI/LLM pipelines, and the Rust rewrite (the affected codebase per the reporter) exposes tenant/collection-scoped HTTP APIs. CWE-639 (Authorization Bypass Through User-Controlled Key) describes precisely this defect class: the request handler accepts a tenant or collection identifier from the caller and operates on it without confirming the authenticated principal is authorized for that tenant, an insecure direct object reference (IDOR) pattern. The CPE cpe:2.3:a:chroma:chromadb confirms the upstream Chroma project, and the issue is in the authorization layer that should gate every CRUD operation on collection objects.
RemediationAI
No vendor-released patch identified at time of analysis from the supplied data - operators should monitor the HiddenLayer advisory (https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-2) and the upstream Chroma project for a fixed release of the Rust server and upgrade as soon as one is published. Until a patched build is available, compensating controls are to deploy a single-tenant-per-instance topology (one ChromaDB process per tenant, isolated by network policy) which removes the cross-tenant target surface entirely at the cost of higher operational overhead, place an authenticating reverse proxy in front of ChromaDB that rewrites or validates the tenant identifier in every request against the caller's identity, and restrict ChromaDB API exposure to trusted internal callers only via network ACLs so that compromised or malicious tenant credentials cannot reach the API directly. Auditing existing collection access logs for cross-tenant identifier use is recommended to detect prior abuse, noting that absence of evidence is not evidence of absence given the silent nature of IDOR exploitation.
Remote code execution in ChromaDB Python (version 1.0.0 and later) allows unauthenticated attackers to execute arbitrary
Authenticated remote code execution in ChromaDB Python project versions 0.4.17 and later enables attackers holding the U
Authorization bypass in ChromaDB's Python implementation lets authenticated tenants reach data outside their authorizati
Cross-tenant authorization bypass in ChromaDB's SimpleRBACAuthorizationProvider (versions 0.5.0 and later) allows authen
Cross-tenant data access in ChromaDB Python project version 0.4.17 and later allows any authenticated user to read, writ
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today