CVE-2026-45833: ChromaDB Code Injection Vulnerability (8.8 CVSS) – Urgent Patch Required

Technical summary

CVE-2026-45833 is a code injection vulnerability (CWE-94) in ChromaDB versions 0.4.17 and later. The flaw resides in the collection update API endpoint (/api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id}) and is triggered when an authenticated principal with UPDATE_COLLECTION permissions supplies a malicious model repository URI while setting trust_remote_code to true. This configuration causes ChromaDB to load and execute untrusted Python code in the server process context, bypassing normal code validation boundaries. The vulnerability requires valid authentication and specific permissions but does not require user interaction.

Business impact

Compromise of a ChromaDB instance enables an attacker to read, modify, or delete all vector data within that database, establish persistent access to the underlying server, or pivot to connected systems. Organizations using ChromaDB for semantic search, AI retrieval-augmented generation (RAG), or embeddings-based analytics face data confidentiality and integrity risks. The impact is elevated in multi-tenant deployments where a single compromised account can affect shared infrastructure. Recovery requires forensic investigation, potential data restoration, and re-authentication of affected users.

Affected systems

ChromaDB versions 0.4.17 through the current release are affected. The trychroma/chromadb open-source project and any downstream distributions or commercial products bundling this library are in scope. Organizations deploying ChromaDB as a standalone service, within Kubernetes clusters, or integrated into Python applications should audit their version and deployment topology. Self-hosted and cloud-based instances are both vulnerable if running affected versions.

Exploitability

Exploitation requires valid authentication and the UPDATE_COLLECTION permission, which is typically granted to application service accounts or privileged users. The attack is trivial to execute once those prerequisites are met—an attacker simply crafts a POST or PUT request to the collection endpoint with a malicious model repository URL and trust_remote_code=true. No public exploit code or active in-the-wild attacks have been reported as of the CVE publication date, but the relative simplicity of exploitation and the severity of code execution mean this should be treated as likely to be weaponized. The CVSS score of 8.8 (High) reflects the combination of network-accessible attack surface, low attack complexity, and complete impact to confidentiality, integrity, and availability.

Remediation

Upgrade ChromaDB to a patched version released after this advisory. Verify the specific patch version in the official ChromaDB release notes and security advisories from the trychroma project. Pending patch availability, disable remote code loading by ensuring trust_remote_code is set to false in all API calls and application configurations. Restrict UPDATE_COLLECTION permissions to only trusted service principals and review audit logs for suspicious collection updates. If ChromaDB is exposed to untrusted networks, place it behind authentication enforced by a reverse proxy and segment it from other infrastructure.

Patch guidance

Check the ChromaDB GitHub repository releases and security advisories for the fixed version number. Apply updates in a staging environment first to verify compatibility with dependent applications. After patching, restart all ChromaDB instances and confirm that trust_remote_code defaults to false in your configuration. For organizations unable to patch immediately, implement compensating controls: restrict network access to the API, enforce strong authentication, and audit collection modification events.

Detection guidance

Monitor HTTP POST and PUT requests to /api/v2/tenants/*/databases/*/collections/* endpoints for payloads containing trust_remote_code=true or unusual model_repository URIs pointing to external or suspicious sources. Log authentication events and permission assignments for UPDATE_COLLECTION roles. Enable process-level monitoring on ChromaDB servers to detect unexpected child process spawning or Python subprocess invocations. Check application logs for errors or warnings related to model loading or remote code execution. Compare deployed ChromaDB versions against the affected range (0.4.17+).

Why prioritize this

This vulnerability merits immediate attention because it enables unauthenticated-to-authenticated privilege escalation, affects a widely-used embeddings database in AI/ML pipelines, and requires minimal attacker sophistication. Although it requires valid credentials and specific permissions, those are often distributed across DevOps teams, CI/CD systems, and application instances. The impact of successful exploitation—arbitrary code execution—is maximal. Organizations relying on ChromaDB for production AI applications should treat this as critical priority.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network-accessible attack surface (AV:N), (2) Low attack complexity with no special conditions beyond valid credentials (AC:L), (3) Requirement for low-privilege authentication and UPDATE_COLLECTION permission (PR:L), (4) No user interaction needed (UI:N), (5) Scope unchanged—impact is confined to the ChromaDB service and data (S:U), and (6) Complete compromise of confidentiality, integrity, and availability of the database and server process (C:H/I:H/A:H). The score appropriately captures the severity of code execution in a backend service context.

Frequently asked questions