Critical severityNVD Advisory· Published May 18, 2026· Updated May 19, 2026
CVE-2026-45829
CVE-2026-45829
Description
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
chromadbPyPI | >= 1.0.0, <= 1.5.9 | — |
Affected products
1- Range: >=1.0.0
Patches
Vulnerability mechanics
References
4News mentions
3- ⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain ChaosThe Hacker News · May 25, 2026
- Max-severity flaw in ChromaDB for AI apps allows server hijackingBleepingComputer · May 19, 2026
- Unpatched ChromaDB Vulnerability Can Lead to Server TakeoverSecurityWeek · May 19, 2026