RCE in Chroma Chromadb
CVE-2026-45829
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS 0.151, 96.8th percentile (scored ); up from 0.010 30 days earlier. About EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.151 · change: +0.141
Affected products
- Chroma Chromadb — versions 1.0.0
Weakness classification (CWE)
Public exploits and proof-of-concept code
4 public repositories with exploit or proof-of-concept code for this CVE:
- 0xBlackash/CVE-2026-45829 (last pushed 2026-05-21): CVE-2026-45829
- 0xredash/CVE-2026-45829 (last pushed 2026-05-21): CVE-2026-45829
- ashrafzaryouh/CVE-2026-45829 (last pushed 2026-05-21): CVE-2026-45829
- fevar54/FULL-ANALYSIS---CVE-2026-45829-ChromaDB- (last pushed 2026-05-20): Analisis completo y PoC de CVE-2026-45829 en ChromaDB.
References
This CVE has public exploit evidence. See the latest CVEs with public exploits.