CVE-2026-45829

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 15.15%
EPSS Percentile: 96.74%
CISA KEV: Not listed

Description

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: 6f8de1f0-f67e-45a6-b68f-98777fdb759c
Published: 19-May-2026 00:16
Last Modified: 26-Oct-2026 20:10
EPSS Date: 2026-11-02
CWE: CWE-94, CWE-502

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

Last enrichment sync: 03-Nov-2026 08:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

CVE-2026-45829 is a max-severity flaw in ChromaDB’s Python FastAPI server that can let unauthenticated attackers execute arbitrary code on exposed systems. Max-Severity ChromaDB Flaw Enables Unauthenticated Code Execution on Exposed Servers
Tracked as CVE-2026-45829 and referred to as ChromaToast, the pre-authentication remote code execution (RCE) flaw could be exploited to leak sensitive information the server has access to, including API keys, Unpatched ChromaDB Flaw Could Enable Pre-Authentication Server Takeover

People (1)

MITRE ATT&CK (1)

Vendors (1)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.