Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-45830

chromadb: ChromaDB: Unauthorized data manipulation due to improper authorization validation

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Chroma Trychroma
Products
Chromadb Chromadb
CVE-2026-45831

ChromaDB: ChromaDB: Unauthorized cross-tenant actions due to improper authorization checks

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Chroma Trychroma
Products
Chromadb Chromadb
CVE-2026-45832

chromadb: ChromaDB: Authorization bypass in V1 collection-level endpoints

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Chroma Trychroma
Products
Chromadb Chromadb
CVE-2026-45833

chromadb: ChromaDB: Arbitrary Code Execution via Code Injection

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Chroma Trychroma
Products
Chromadb Chromadb
CVE-2026-8828

Arbitrary Data Access and Modification in ChromaDB due to Missing Authorization Checks

A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Chroma
Products
Chromadb
CVE-2026-45829

chromadb: ChromaDB Python Project: Arbitrary code execution via pre-authentication code injection

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

CVSS 4.0 · 10 Critical EPSS 15.1% KEV · Not listed
Vendors
Chroma
Products
Chromadb