CVE-2026-45830 Overview
CVE-2026-45830 is an authorization bypass vulnerability in the ChromaDB Python project, affecting versions 0.4.17 and later. The flaw stems from missing authorization validation on tenant-scoped operations. Any authenticated user can read, write, update, or delete data in any other tenant's collection, regardless of their assigned tenant. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key and is exploitable over the network with low privileges. ChromaDB is widely deployed as a vector database for retrieval-augmented generation (RAG) and large language model (LLM) pipelines, making cross-tenant data exposure especially relevant in multi-tenant AI applications.
Critical Impact
Authenticated users can break tenant isolation to access or destroy embedding collections belonging to other tenants, compromising confidentiality and integrity of vector data used by downstream AI systems.
Affected Products
- trychroma:chromadb Python package, version 0.4.17 and later
- Self-hosted ChromaDB deployments using multi-tenant configurations
- Applications embedding ChromaDB as a vector store for RAG and LLM workloads
Discovery Timeline
- 2026-06-12 - CVE-2026-45830 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-45830
Vulnerability Analysis
ChromaDB exposes a multi-tenant API where collections are scoped under a tenant and database. The server is expected to validate that the authenticated identity making a request belongs to the tenant referenced in the request path or payload. In affected versions, this check is absent. The tenant identifier supplied by the caller is trusted without comparing it to the identity's authorized tenant. The result is a horizontal authorization bypass that lets any authenticated principal pivot across tenant boundaries.
Because ChromaDB stores embeddings and metadata that often originate from sensitive corpora, such as internal documents, customer records, or proprietary knowledge bases, cross-tenant reads disclose downstream business data. Cross-tenant writes and deletes can corrupt or destroy embedding stores, degrading or poisoning the responses of LLM applications that query them.
Root Cause
The root cause is missing server-side enforcement that ties the authenticated identity to a specific tenant scope. Authorization decisions rely on a user-controlled tenant key rather than a server-side mapping, which is the pattern described by CWE-639. Authentication succeeds, but authorization is never re-evaluated against the tenant in the request.
Attack Vector
An attacker needs valid credentials for any tenant on the target ChromaDB instance. From there, they issue standard ChromaDB API calls, but substitute another tenant's identifier in the request. The server processes the operation against the targeted tenant's collections. No user interaction is required and complexity is low. Refer to the HiddenLayer Security Advisory for additional technical details. No public exploit code or proof-of-concept has been catalogued at the time of publication.
Detection Methods for CVE-2026-45830
Indicators of Compromise
- API requests in which the tenant identifier in the URL or payload does not match the tenant associated with the authenticated API key or token.
- Unexpected list_collections, get, add, update, upsert, or delete operations from accounts that historically only touched a single tenant.
- Sudden growth, truncation, or deletion of collections belonging to tenants that the calling identity does not own.
Detection Strategies
- Enable ChromaDB server access logging and parse logs for the tenant and database fields alongside the authenticated principal, alerting when these diverge.
- Deploy a reverse proxy or API gateway in front of ChromaDB that asserts tenant ownership for every request before forwarding it.
- Correlate ChromaDB audit events with identity provider logs to flag any principal accessing more than one tenant within a short window.
Monitoring Recommendations
- Track baseline tenant-to-identity mappings and alert on first-seen cross-tenant access patterns.
- Monitor collection mutation rates per tenant to catch destructive cross-tenant writes or deletes.
- Capture network telemetry on ChromaDB endpoints to detect unauthenticated scanning or credential reuse against /api/v1/tenants and /api/v1/collections routes.
How to Mitigate CVE-2026-45830
Immediate Actions Required
- Upgrade ChromaDB to a fixed version once published by the maintainers and tracked in the HiddenLayer Security Advisory.
- Restrict network exposure of ChromaDB to trusted application backends only and remove any direct internet exposure.
- Rotate all ChromaDB API keys and authentication tokens to invalidate credentials that may have been used for cross-tenant access.
- Audit collection contents in every tenant for unexpected additions, modifications, or deletions since 0.4.17 was deployed.
Patch Information
Review the HiddenLayer Security Advisory for the current patched version of chromadb. Upgrade the Python package on every server-side deployment and rebuild any container images that pin an affected version.
Workarounds
- Place ChromaDB behind an authenticating proxy that validates the tenant identifier in each request against the caller's identity before proxying.
- Run a separate ChromaDB instance per tenant to eliminate the shared multi-tenant attack surface until the patch is applied.
- Enforce least-privilege API keys and revoke any token that is not strictly required by an application component.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
