CVE-2026-45829

CVSS 10 CRITICALEPSS 12.4%CWE-502 CWE-94

Vexday Risk Score

53Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 10EPSS 12.4%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

18 May 2026Published on NVD

20 May 2026Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected products

Chroma · ChromaDB

public PoCs found — 2

githubgithub.com/fevar54/FULL-ANALYSIS---CVE-2026-45829-ChromaDB-★ 0 githubgithub.com/0xBlackash/CVE-2026-45829★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://access.redhat.com/security/cve/CVE-2026-45829 https://bugzilla.redhat.com/show_bug.cgi?id=2479623 https://github.com/chroma-core/chroma/issues/6717 https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45829.json https://www.hiddenlayer.com/research/chromatoast-served-pre-auth