QwikSec

Security Database

CVE

CWE

Training

CVE-2026-45829

Published: May 18, 2026

Modified: May 19, 2026

PUBLISHED

Description

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

Vendor	Product	Versions
Chroma	ChromaDB	affected `1.0.0 - <= *`

Weaknesses (CWE)

References

https://www.hiddenlayer.com/research/chromatoast-served-pre-auth

https://github.com/chroma-core/chroma/issues/6717

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.