Unpatched ChromaDB Flaw Could Enable Pre-Authentication Server Takeover
Summary
HiddenLayer reports that CVE-2026-45829 lets unauthenticated attackers execute a malicious HuggingFace model before ChromaDB authentication, potentially gaining server-process control. ChromaDB 1.5.8 remains unpatched; restricting network access is a mitigation.
Key points
- HiddenLayer reports that CVE-2026-45829, also called ChromaToast, is a pre-authentication remote code execution flaw in ChromaDB.
- The reported exploit sends a collection creation request referencing a crafted HuggingFace model, which the server downloads and executes before checking authentication.
- Successful exploitation could give an attacker control of the server process and access to files, API keys, environment variables, and mounted secrets reachable by it.
- HiddenLayer says all ChromaDB versions since 1.0.0 are affected and estimates roughly 73% of internet-accessible deployments are vulnerable.
- The article says the flaw was not patched as of ChromaDB 1.5.8; restricting network access to trusted clients is suggested as a mitigation.
- HiddenLayer and independent researcher Azraelxuemo reportedly attempted to notify Chroma, but had received no response.
Article Details
- Vulnerability Types
- Pre-authentication remote code execution (RCE)
- Affected Versions
- ChromaDB 1.0.0 and later
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Restrict network access to ChromaDB to trusted clients only.