CVE-2026-45829
Published May 18, 2026
Last updated 9 days ago
AI description
CVE-2026-45829 describes a pre-authentication code injection vulnerability found in version 1.0.0 and later of the ChromaDB Python project. This flaw allows an unauthenticated attacker to execute arbitrary code on the server. The vulnerability is exploited by sending a specially crafted malicious model repository with the `trust_remote_code` parameter set to true to the `/api/v2/tenants/{tenant}/databases/{db}/collections` endpoint. This can lead to the server loading and running the attacker's arbitrary code.
- Description
- A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
- Source
- 6f8de1f0-f67e-45a6-b68f-98777fdb759c
- NVD status
- Awaiting Analysis
CVSS 4.0
- Type
- Secondary
- Base score
- 10
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- CRITICAL
CVSS 3.1
- Type
- Secondary
- Base score
- 10
- Impact score
- 6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
- Hype score
- Not currently trending
CVE-2026-45829 — ChromaDB pre-auth RCE. CVSS 10.0. FastAPI auth bypass → unauthenticated full server compromise. Hits LangChain, AutoGen, CrewAI, all RAG stacks. Firewall port 8000/tcp. Patch now. #ThreatIntel #CVE #ZeroDay #CVE202645829
@NoctisIntel
22 May 2026
140 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
Legacy exposure keeps paying off for attackers. CVE-2026-45829: ChromaDB Pre-Auth RCE Risk in AI Stacks CVE-2026-45829 lets attackers hijack internet-exposed ChromaDB servers used in AI apps. Pat… 🔗 Read → https://t.co/Fe3ebpEsRW
@fynn_JourX
20 May 2026
51 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🛑 CVE-2026-45829: ChromaDB Pre-Auth RCE Risk in AI Stacks CVE-2026-45829 lets attackers hijack internet-exposed ChromaDB servers used in AI apps. Pat… 🔗 Details → https://t.co/4PC0a5VwJ4
@lucasverdan
20 May 2026
50 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
For defenders, cve-2026-45829: chromadb pre-auth rce risk in ai stacks should move fast. CVE-2026-45829 lets attackers hijack internet-exposed ChromaDB servers used in AI apps. Pat… 🔗 Details → https://t.co/C7XNF18w7x
@SocXAInvaders
20 May 2026
7 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2026-45829: ChromaToast Served Pre-Auth Demo Demonstration of CVE-2026-45829 from the "ChromaToast Served Pre-Auth" blog. https://t.co/WJC5MqwDfT
@DarkWebInformer
19 May 2026
6323 Impressions
4 Retweets
27 Likes
11 Bookmarks
8 Replies
0 Quotes