CVE-2026-45830

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

CVSS 4.0

8.8CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-25)

CWEs

CWE-639, CWE-266

Published

2026-06-12

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• trychroma:chromadb

Packages (OSV)

References

• https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb
• https://access.redhat.com/security/cve/CVE-2026-45830
• https://bugzilla.redhat.com/show_bug.cgi?id=2488408
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45830.json

Check your stackJSON