What is CVE-2026-45830?

CVE-2026-45830 is a high-severity vulnerability in Chroma Chromadb, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 8.8/10. Published 2026-06-12.

How severe is CVE-2026-45830?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Chroma Chromadb

CVE-2026-45830

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belon…

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.003 (27.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Chroma Chromadb — versions 0.4.17
Trychroma Chromadb

Weakness classification (CWE)

References

6f8de1f0-f67e-45a6-b68f-98777fdb759c (Third Party Advisory)
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Frequently asked questions

What is CVE-2026-45830?: CVE-2026-45830 is a high-severity vulnerability in Chroma Chromadb, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 8.8/10. Published 2026-06-12.
How severe is CVE-2026-45830?: High severity. CVSS v3 base score is 8.8 out of 10.