CVE-2026-45829: ChromaDB Pre-Auth RCE Vulnerability

CVE-2026-45829 Overview

CVE-2026-45829 is a pre-authentication code injection vulnerability in the ChromaDB Python project, version 1.0.0 and later. An unauthenticated attacker can execute arbitrary code on the server by submitting a malicious model repository with trust_remote_code set to true through the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint. ChromaDB is widely used as a vector database backing retrieval-augmented generation (RAG) workloads and AI applications. The flaw is tracked under CWE-94: Improper Control of Generation of Code and requires no authentication, user interaction, or privileges to exploit over the network.

Critical Impact
Unauthenticated remote code execution on ChromaDB servers, exposing AI/ML data pipelines and any infrastructure reachable from the vector database host.

Affected Products

ChromaDB Python project version 1.0.0 and later
Deployments exposing the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint
AI/ML pipelines using ChromaDB as a vector store with remote model loading enabled

Discovery Timeline

2026-05-18 - CVE-2026-45829 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-45829

Vulnerability Analysis

The vulnerability resides in the collections creation endpoint of the ChromaDB v2 API. The endpoint accepts an embedding function configuration that references a model repository. When the request includes trust_remote_code=true, ChromaDB downloads and executes Python code packaged with the referenced model repository without validation. Because the endpoint is reachable before authentication, any network-adjacent attacker can trigger remote code execution. The HiddenLayer research team published technical analysis of the issue under the name "Chromatoast Served Pre-Auth." See the HiddenLayer Research Paper and GitHub Issue #6717 for the disclosure thread.

Root Cause

The root cause is unsafe handling of user-controlled model loading parameters [CWE-94]. ChromaDB honors the trust_remote_code flag supplied by the API caller and passes it directly to the underlying model loader. Python files contained in the remote repository execute in the ChromaDB process context. The endpoint also lacks authentication enforcement in default deployments, removing the only remaining trust boundary.

Attack Vector

An attacker sends a crafted HTTP POST request to the collections endpoint of a reachable ChromaDB server. The request body specifies an embedding function configuration pointing to an attacker-controlled model repository and sets trust_remote_code to true. ChromaDB fetches the repository, imports the malicious Python modules, and runs the attacker's payload with the privileges of the server process. The attacker gains command execution, access to vector store contents, embedded credentials, and any cloud metadata services reachable from the host.

// Exploitation flow (described, not executable)
// 1. Attacker hosts a model repository containing malicious Python code in its loader hooks.
// 2. Attacker sends POST /api/v2/tenants/{tenant}/databases/{db}/collections
//    with an embedding function configuration referencing the malicious repo
//    and trust_remote_code: true.
// 3. ChromaDB fetches the repo and executes the attacker's Python code in-process.
// 4. Attacker obtains RCE as the ChromaDB service user.

Detection Methods for CVE-2026-45829

Indicators of Compromise

HTTP requests to /api/v2/tenants/*/databases/*/collections containing trust_remote_code set to true
Outbound network connections from the ChromaDB process to model hubs or unfamiliar Git or HTTP endpoints during collection creation
Unexpected child processes spawned by the ChromaDB Python interpreter, including shells, curl, or wget
New or modified Python files written under the ChromaDB cache directory followed by execution

Detection Strategies

Inspect application and reverse-proxy logs for POST requests to the v2 collections endpoint with embedding function payloads referencing external repositories
Alert on process lineage where the ChromaDB service spawns interactive shells or networking utilities
Monitor for DNS resolution and TLS connections from ChromaDB hosts to model repository hosts not on an approved allowlist

Monitoring Recommendations

Enable verbose API access logging on ChromaDB and forward logs to a central analytics platform for retention and correlation
Baseline normal embedding model usage and alert on deviations such as new repository sources or trust_remote_code=true flags
Monitor egress traffic from AI/ML infrastructure subnets for connections to code hosting services

How to Mitigate CVE-2026-45829

Immediate Actions Required

Restrict network exposure of ChromaDB API endpoints to trusted application tiers only and block public internet access
Enforce authentication on the ChromaDB server and reject unauthenticated requests to v2 endpoints
Audit existing collections for embedding function configurations that reference external repositories with trust_remote_code enabled
Track upstream remediation through GitHub Issue #6717 and apply patches when released

Patch Information

No fixed version is listed in the NVD record at the time of publication. Refer to the upstream tracking discussion in GitHub Issue #6717 for remediation status and any released advisories from the ChromaDB maintainers.

Workarounds

Place ChromaDB behind a reverse proxy that requires authentication and strips or rejects requests setting trust_remote_code=true
Run ChromaDB in a sandboxed container with no outbound internet access to prevent fetching of remote model repositories
Operate the service under a dedicated unprivileged user account with minimal filesystem and cloud IAM privileges to limit blast radius

bash

# Example reverse-proxy rule to block trust_remote_code in request bodies
# nginx snippet (illustrative)
location ~ ^/api/v2/tenants/.+/databases/.+/collections$ {
    if ($request_body ~* "trust_remote_code\"\s*:\s*true") {
        return 403;
    }
    proxy_pass http://chromadb_upstream;
}