Reported by 1 outlet
ChromaDB CVE-2026-45829 (CVSS 10) — Max-Severity Unpatched Flaw Enables Server Hijacking
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 4.90 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
ChromaDB CVE-2026-45829 (CVSS 10) — Max-Severity Unpatched Flaw Enables Server Hijacking
bleepingcomputer.com · 147d ago · May 20th, 2026
A maximum-severity vulnerability in the ChromaDB open-source vector database (14M monthly PyPI downloads) allows unauthenticated attackers to run arbitrary code on exposed servers. The flaw, tracked as CVE-2026-45829 and reported to ChromaDB on February 17, resides in the Python FastAPI server — the Rust frontend is not affected. The vulnerability exploits an authentication-ordering flaw: a vulnerable API endpoint marked as authenticated allows attackers to embed model settings before the authentication check fires. An attacker sends a crafted request forcing ChromaDB to load a malicious model from Hugging Face and execute it locally — by the time the server rejects the request (HTTP 500), the attacker's payload has already run. HiddenLayer researchers have been unable to contact the maintainer since February 17; 73% of internet-exposed instances run a vulnerable version per Shodan telemetry. Mitigations: use the Rust frontend, avoid exposing the Python API publicly, or restrict network access to the API port.