CVE-2026-45829
CriticalCVSS 10.0Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A pre-authentication code injection vulnerability in ChromaDB Python (version 1.0.0 and later) allows an unauthenticated attacker to execute arbitrary code on the server by sending a malicious model repository with trust_remote_code set to true to the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
Risk Assessment
An attacker can take over the server, steal data, install malware, or disrupt service, posing a critical threat to confidentiality, integrity, and availability.
Recommendation
Immediately update ChromaDB to the latest patched version and disable the trust_remote_code option in configuration if not required. Additionally, restrict access to the endpoint to trusted networks only.
Original NVD description (English source)
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.