CVSS 10.0CVSS 10.0 · CRITICAL
CVE-2026-45829
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
Ver en NVDSeveridad
Puntaje: 10.0(CRITICAL)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HAV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: CHANGED
C: HIGH
I: HIGH
A: HIGH
Tipo de falla (CWE):
CWE-94CWE-502EPSS
Probabilidad de explotación (próx. 30 días): 0.1027 (10.3%)
Percentil: 95.1%
EPSS: 2026-06-26
Descripción técnica
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
Publicada: 18/5/2026, 17:16:34
Última modificación: 27/6/2026, 5:16:46
Referencias
- https://github.com/chroma-core/chroma/issues/6717
- https://www.hiddenlayer.com/research/chromatoast-served-pre-auth
- https://access.redhat.com/security/cve/CVE-2026-45829
- https://bugzilla.redhat.com/show_bug.cgi?id=2479623
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45829.json
- https://www.hiddenlayer.com/research/chromatoast-served-pre-auth