Maximum severity flaw in ChromaDB for AI apps allows server hijacking

A most severity vulnerability within the newest Python FastAPI model of the ChromaDB challenge might enable an unauthenticated attacker to execute arbitrary code on an uncovered server.

This flaw was tracked as CVE-2026-45829 and reported to ChromaDB on February seventeenth. We acquired the utmost severity rating from HiddenLayer, the corporate that found this flaw.

ChromaDB is an open-source vector database and AI search backend utilized by agent AI and associated purposes. This permits retrieval of semantically associated paperwork throughout Giant-Scale Language Mannequin (LLM) inference.

This flaw impacts codebases that comprise weak Python API server logic, placing practically 14 million PyPI packages downloaded every month in danger if the server is accessible by way of HTTP.

Customers who deploy their API servers regionally with out exposing them on-line and those that use the Rust entrance finish aren’t affected by CVE-2026-45829.

In keeping with HiddenLayer, a weak API endpoint that’s marked as authenticated permits an attacker to embed mannequin configuration earlier than authentication is checked.

An attacker might ship a crafted request to trigger ChromaDB to load a malicious mannequin from the Hugging Face platform and execute it regionally. Authentication checks are carried out solely after that step and safety is bypassed.

“It isn’t that the authentication is lacking, it is simply within the incorrect place,” HiddenLayer explains.

“By the point the assault begins, the mannequin has already been fetched and executed. The server rejects the request and returns a 500. And the attacker’s payload has already been executed.”

publicity and mitigation

Researchers report that the flaw was launched in ChromaDB 1.0.0 and was unpatched in model 1.5.8. Two weeks in the past, the maintainers launched model 1.5.9. Nevertheless, it’s unclear whether or not the safety challenge has been mounted.

Since February seventeenth, HiddenLayer researchers have tried to contact the developer a number of occasions by way of e-mail and social media, however acquired no response.

BleepingComputer reached out to the Chroma crew relating to the standing of CVE-2026-45829, however didn’t obtain a response by the point of publication. We’ll replace this text if extra particulars develop into out there.

In keeping with a question on Shodan, roughly 73% of cases uncovered to the web are operating a weak model of Chroma.

Till it’s identified that CVE-2026-45829 has been patched, the advice for affected customers is to decide on Rust frontends for deployments or not expose Python servers. One other mitigation is to limit community entry to the ChromaDB API port.

The researchers additionally suggest scanning ML mannequin artifacts earlier than execution, as loading a public mannequin utilizing “trust_remote_code” successfully means operating untrusted code.