CVE-2026-45832
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability in ChromaDB allows bypassing authorization controls by using V1 endpoints, which pass None for tenant and database to the authorization layer.
Risk Assessment
An attacker can gain unauthorized access to data collections, leading to confidentiality and integrity breaches of stored information.
Recommendation
Immediately update ChromaDB to a version that fixes authorization handling for V1 endpoints and verify access control configuration.
Other vulnerabilities in ChromaDB
See all- CVE-2026-45829Critical
A pre-authentication code injection vulnerability in ChromaDB Python (version 1.0.0 and later) allows an unauthenticated attacker to execute arbitrary code on the server by sending a malicious model repository with trust_remote_code set to true to the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
- CVE-2026-45833High
A code injection vulnerability in ChromaDB version 0.4.17 and later allows an authenticated attacker with UPDATE_COLLECTION permission to execute arbitrary code on the server by sending a malicious model repository with trust_remote_code set to true.
- CVE-2026-45830High
ChromaDB version 0.4.17 and later lacks authorization validation, allowing any authenticated user to arbitrarily read, write, update, or delete data in any tenant's collection regardless of their tenant membership.
Original NVD description (English source)
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.