CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

ChromaDB

product · product:chromadb

Coverage
1
first 2026-05-21 → last 2026-10-21
Latest activity
2026-05-21
ChromaDB CVE-2026-45829: one unauthenticated create-collection request runs attacker Python on the Python…
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
2
2 hosts

Defender insights

What each entry about ChromaDB tells a defender to do, newest first.

2026-05-21NOTABLEChromaDB CVE-2026-45829: one unauthenticated create-collection request runs attacker Python on the Python FastAPI server

Exposure · triage · detection

Story timeline

  1. 2026-05-21CVE-2026-45829: ChromaDB's Python FastAPI server runs an attacker's model code before checking authentication (CVSS 4.0 10.0), no fix in 1.5.9
    trending-vulnerabilitiesChromaDB CVE-2026-45829: one unauthenticated create-collection request runs attacker Python on the Python FastAPI server

Hunting pivots

CVEs
CVE-2026-45829
Releases covered
ChromaDB
Tags
ai-abuseno-patchpoc-publicpre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter: Python

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-21/cve-2026-45829-chromadb-python-fastapi-server-pre-auth-rce-v · ATT&CK page ↗

Execution TA0002

T1059.006Command and Scripting Interpreter: Python×1

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.

Evidence: 2026-05-21/cve-2026-45829-chromadb-python-fastapi-server-pre-auth-rce-v · ATT&CK page ↗

Entries about ChromaDB (1)

2026-05-21 · view entry permalink →

NOTABLECVE-2026-45829updatedNATOB1

CVE-2026-45829: ChromaDB's Python FastAPI server runs an attacker's model code before checking authentication (CVSS 4.0 10.0), no fix in 1.5.9

HiddenLayer discovered CVE-2026-45829 in ChromaDB's Python FastAPI server and gave it the maximum severity score (BleepingComputer, 2026-05-19); Hadrian, which published a technical analysis the same day, gives CVSS 4.0 10.0 and repeats HiddenLayer's name for it, "ChromaToast", (Hadrian, 2026-05-19). The create-collection handler loads the request's embedding-function configuration before it checks authentication: with trust_remote_code set to true and model_name pointed at a HuggingFace repository or local path the attacker controls, the server downloads and instantiates the model and runs the attacker's Python inside the uvicorn server process (Hadrian, 2026-05-19), and only then rejects the request, with a 500 in HiddenLayer's description (BleepingComputer, 2026-05-19). Every Python FastAPI server from 1.0.0 is affected while the default Rust frontend does not use this code path, and there was no fixed version at the time of writing, 1.5.9 being the latest (Hadrian, 2026-05-19). HiddenLayer reports an initial acknowledgement on 2025-12-16 followed by silence across more than ten follow-ups (Hadrian, 2026-05-19), and its Shodan queries found roughly 73% of internet-exposed instances running a vulnerable version (BleepingComputer, 2026-05-19); Hadrian dates the report to 2025-11-28 (Hadrian, 2026-05-19), BleepingComputer to February 17 (BleepingComputer, 2026-05-19).

Triage: HuggingFace downloads started by your own ingestion code are normal; the same download from the Chroma server process that your ingestion code did not initiate is the signal (Hadrian, 2026-05-19).

Only the Python server is affected. The Rust server doesn't go through this code path.

There is no fixed version at time of writing (latest is 1.5.9).

Hadrian 2026-05-19

The server rejects the request, returns a 500, and the attacker's payload has already run.

BleepingComputer 2026-05-19
Correctionrun 2026-10-21T1148Z-auditactionsaffected_productsbodyclassificationcvesevidenceheadlinesectorssourcessourcing_notesummarytechniquestitle

No server-wide setting turns trust_remote_code off: the flag travels in the attacker's own create-collection request, inside the embedding-function arguments (Hadrian, 2026-05-19), and the sourced mitigations are the Rust frontend, keeping the Python server off public networks and restricting access to the API port (BleepingComputer, 2026-05-19). The rejection that follows the payload is a 500 in HiddenLayer's description (BleepingComputer, 2026-05-19) and in Hadrian's own proof of concept, although Hadrian's summary says 403 (Hadrian, 2026-05-19). HiddenLayer discovered and scored the flaw (BleepingComputer, 2026-05-19), and Hadrian published the technical analysis (Hadrian, 2026-05-19).

vulnerability21 May 05:00Zmulti-sourceOpen finding →
Sources: Hadrian · BleepingComputer

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (50%)
  • hadrian.io1 (50%)
All cited sources (2)