CVE-2026-45832

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

CVSS 4.0

8.8CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-25)

CWEs

CWE-639, CWE-551

Published

2026-06-12

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• trychroma:chromadb

References

• https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-4
• https://access.redhat.com/security/cve/CVE-2026-45832
• https://bugzilla.redhat.com/show_bug.cgi?id=2488411
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45832.json

Check your stackJSON