Vulnerabilities

CVSS

10.0 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk score

80.0

Published

2026-05-18

Status

Published

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

Weaknesses

CWE-94CWE-502

Coverage 2

threat-intel

⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos

This week’s security news highlights a significant GitHub breach orchestrated by TeamPCP, stemming from a compromised developer’s device and leveraging vulnerabilities exposed by the TanStack supply chain attack. Simulta…

The Hacker News · May 25, 2026 High

CVE-2026-46333CVE-2026-41091CVE-2026-45498USGBsupply-chainlinuxgithub

vulnerability

Max-severity flaw in ChromaDB for AI apps allows server hijacking

A critical vulnerability (CVE-2026-45829) has been identified in the ChromaDB project, allowing unauthenticated attackers to execute arbitrary code on exposed servers. This flaw stems from a misplacement of authenticatio…

BleepingComputer · May 19, 2026 Critical

CVE-2026-45829apipythonfastapi

All articles mentioning it

Advisories and references

• hiddenlayer.com/research/chromatoast-served-pre-auth
• github.com/chroma-core/chroma/issues/6717
• access.redhat.com/security/cve/CVE-2026-45829
• bugzilla.redhat.com/show_bug.cgi?id=2479623
• security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45829.json