ChromaDB vulnerabilities
4 known CVE vulnerabilities in ChromaDB, translated and rated.
- CVE-2026-45829Critical
A pre-authentication code injection vulnerability in ChromaDB Python (version 1.0.0 and later) allows an unauthenticated attacker to execute arbitrary code on the server by sending a malicious model repository with trust_remote_code set to true to the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
- CVE-2026-45833High
A code injection vulnerability in ChromaDB version 0.4.17 and later allows an authenticated attacker with UPDATE_COLLECTION permission to execute arbitrary code on the server by sending a malicious model repository with trust_remote_code set to true.
- CVE-2026-45832High
A vulnerability in ChromaDB allows bypassing authorization controls by using V1 endpoints, which pass None for tenant and database to the authorization layer.
- CVE-2026-45830High
ChromaDB version 0.4.17 and later lacks authorization validation, allowing any authenticated user to arbitrarily read, write, update, or delete data in any tenant's collection regardless of their tenant membership.