Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-92782

Chroma through 1.5.9 Authorization Bypass via Collection Identifier

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Chroma-core
Products
Chroma
CVE-2026-85664

Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustion

Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Chroma-core
Products
Chroma