By vendor

Trychroma vulnerabilities

Known CVEs affecting Trychroma products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2026-45830HIGH 8.8

  ChromaDB, a Python vector database project, contains a critical authorization flaw that allows any logged-in user to access, modify, or delete data belonging to other tenants. The vulnerability affects version 0.4.17 and later. Because authorization checks are missing, a legitimate user of one tenant can perform full read, write, update, and delete operations on collections in any other tenant's isolated data space. This is particularly severe in multi-tenant deployments where data isolation is a core security assumption.

• CVE-2026-45832HIGH 8.8

  ChromaDB's Python implementation contains an authorization bypass vulnerability affecting its V1 collection-level API endpoints. When users interact with collections through V1 endpoints, the system fails to properly pass tenant and database identifiers to its authorization layer, effectively disabling access controls. An authenticated attacker can exploit this to access collections they should not have permission to view or modify. The vulnerability requires valid credentials but allows attackers to escalate privileges within the ChromaDB instance.

• CVE-2026-45833HIGH 8.8

  ChromaDB, a popular Python vector database project, contains a code injection flaw that allows authenticated users with collection update permissions to execute arbitrary code on the server. The vulnerability exists in version 0.4.17 and later when a malicious model repository is supplied along with remote code execution enabled. This is a post-authentication attack that requires legitimate access to the system but can escalate privileges and compromise server integrity.