CVE-2026-45832: Trychroma ChromaDB Auth Bypass Flaw

CVE-2026-45832 Overview

CVE-2026-45832 is an authorization bypass vulnerability in ChromaDB, an open-source vector database widely used in AI and retrieval-augmented generation (RAG) pipelines. All V1 collection-level endpoints in the ChromaDB Python project pass None for the tenant and database arguments when invoking the authorization layer. This causes the authorization checks to evaluate against null context, allowing authenticated attackers with limited privileges to access resources belonging to other tenants and databases. The flaw is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key]. The issue was disclosed in the HiddenLayer Security Advisory.

Critical Impact
Attackers with low-privilege accounts can bypass tenant and database isolation by routing requests through the V1 collection-level API, exposing high-confidentiality and high-integrity data across the ChromaDB deployment.

Affected Products

Trychroma ChromaDB (Python distribution)
ChromaDB deployments exposing V1 collection-level REST endpoints
Multi-tenant ChromaDB instances relying on the built-in authorization layer

Discovery Timeline

2026-06-12 - CVE-2026-45832 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-45832

Vulnerability Analysis

ChromaDB exposes two generations of HTTP APIs. The V1 collection-level endpoints handle operations such as creating, reading, updating, and deleting collections and their embedded vectors. When these handlers forward requests to the internal authorization layer, they supply None as both the tenant identifier and the database identifier. The authorization layer interprets the missing context as an unscoped request and permits the operation to proceed.

An authenticated attacker with credentials for any tenant can invoke the V1 endpoints and operate against arbitrary collections. This breaks the multi-tenant isolation model that ChromaDB uses to separate customer data, embeddings, and metadata. The vulnerability impacts confidentiality and integrity of stored vectors, including embeddings derived from proprietary documents in RAG systems.

Root Cause

The root cause is incomplete propagation of tenant and database context through the V1 routing layer. The handlers do not extract the caller's tenant and database from the request context before invoking authorization. Because the authorization function receives None, it cannot enforce per-tenant access control lists, resulting in horizontal privilege escalation between tenants.

Attack Vector

Exploitation requires network access to the ChromaDB server and a valid low-privilege account on the instance. The attacker issues HTTP requests to V1 collection endpoints referencing collections owned by other tenants. The server returns the requested data or applies the requested modification because the authorization layer cannot scope the check. No user interaction is required. The V2 endpoints, which correctly pass tenant and database context, are not affected.

No public proof-of-concept exploit code has been released. Refer to the HiddenLayer Security Advisory for technical details of the vulnerable code path.

Detection Methods for CVE-2026-45832

Indicators of Compromise

Requests to ChromaDB V1 collection endpoints (paths beginning with /api/v1/collections) from accounts that have not been provisioned access to the targeted collection identifiers.
Successful read or write responses on V1 endpoints where the requesting principal's tenant does not match the collection owner's tenant.
Sudden growth in cross-tenant access patterns in ChromaDB application logs.

Detection Strategies

Enable verbose request logging on the ChromaDB server and parse logs for V1 endpoint usage paired with collection UUIDs that do not belong to the authenticated principal.
Correlate ChromaDB access logs with identity provider records to detect tenant mismatches.
Deploy a reverse proxy or API gateway in front of ChromaDB to enforce tenant-scoped path filtering and alert on V1 endpoint usage.

Monitoring Recommendations

Forward ChromaDB application logs and the fronting proxy logs to a centralized SIEM for retention and analysis.
Build a baseline of expected V1 versus V2 endpoint traffic and alert on deviations.
Monitor for enumeration patterns such as sequential collection identifier requests from a single source.

How to Mitigate CVE-2026-45832

Immediate Actions Required

Upgrade ChromaDB to the fixed release identified in the HiddenLayer Security Advisory.
Block or restrict access to V1 collection-level endpoints at the network or proxy layer until the patch is applied.
Rotate API tokens and credentials issued to ChromaDB tenants if cross-tenant access cannot be ruled out.

Patch Information

The maintainers have addressed the issue by propagating the authenticated tenant and database identifiers into the authorization layer for all V1 collection-level handlers. Administrators should consult the vendor advisory linked above for the exact fixed version and upgrade instructions. After upgrading, validate that V1 endpoints reject cross-tenant requests.

Workarounds

Disable V1 collection-level endpoints on the reverse proxy and require clients to migrate to the V2 API, which correctly enforces tenant and database scoping.
Restrict ChromaDB network exposure to trusted application servers and remove direct client access from untrusted networks.
Apply per-tenant network segmentation by deploying isolated ChromaDB instances for sensitive workloads until the patch is in place.

bash

# Example nginx rule to block V1 collection endpoints
location ~ ^/api/v1/collections {
    return 403;
}