ChromaDB Model Trust Bug Opens Pre-Auth Server Takeover
ChromaDB is treating client-supplied model identifiers as trusted input before auth, so exposed instances can hand attackers shell access before any login check runs. That turns the model-selection path into code execution, and patching later does not undo the secrets a hostile request can read on the way in.
SecurityWeek reports the unpatched flaw as CVE-2026-45829 in ChromaDB 1.5.8. HiddenLayer says exploitation can leak API keys, environment variables, mounted secrets, and files on disk, and that the issue affects all ChromaDB releases since 1.0.0 across a large share of internet-exposed deployments.
The practical risk is broader than a single database service outage. Any AI stack exposing ChromaDB may inherit server-level secret exposure and persistence of stolen data long after the vulnerable endpoint is fixed.
Unpatched ChromaDB flaw leaves servers open to remote code execution
The ChromaToast vulnerability can be exploited by forcing the ChromaDB API server to fetch and load maliciously crafted AI models before authentication is checked.
Max-severity flaw in ChromaDB for AI apps allows server hijacking
A max-severity vulnerability in the latest Python FastAPI version of the ChromaDB project allows unauthenticated attackers to run arbitrary code on exposed servers.