Max-Severity ChromaDB Flaw Enables Unauthenticated Code Execution on Exposed Servers
Summary
HiddenLayer reports that CVE-2026-45829 lets unauthenticated attackers execute code on exposed ChromaDB Python servers by loading a malicious model before authentication. Versions 1.0.0–1.5.8 are affected; 1.5.9's status is unclear.
Key points
- HiddenLayer says the flaw affects ChromaDB’s Python FastAPI server and can allow unauthenticated code execution on servers exposed over HTTP.
- A crafted request can cause the server to load and execute a malicious model from Hugging Face before its authentication check runs.
- The researchers report that ChromaDB versions 1.0.0 through 1.5.8 are vulnerable; whether version 1.5.9 fixes the issue remains unclear.
- Local deployments that do not expose the API server and deployments using the Rust frontend are reported not to be affected.
- Until patch status is clear, recommendations include using the Rust frontend, avoiding public exposure of the Python server, and restricting access to its API port.
- HiddenLayer also recommends scanning model artifacts before runtime because loading models with trust_remote_code can execute untrusted code.
- HiddenLayer’s Shodan queries found that roughly 73% of internet-exposed instances were running a vulnerable version.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Severity
- Maximum severity; no numeric score is provided
- Affected Versions
- ChromaDB 1.0.0 through 1.5.8
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- unknown
- Workarounds
- Use the Rust frontend.
- Avoid exposing the Python server publicly.
- Restrict network access to the ChromaDB API port.
- Scan ML model artifacts before runtime.