CVE-2026-45833: Trychroma ChromaDB RCE Vulnerability

CVE-2026-45833 Overview

CVE-2026-45833 is a code injection vulnerability in the ChromaDB Python project, an open-source vector database used in AI and retrieval-augmented generation (RAG) workloads. The flaw affects ChromaDB version 0.4.17 and later. An authenticated attacker holding the UPDATE_COLLECTION permission can execute arbitrary code on the server by submitting a malicious model repository with trust_remote_code set to true against the collection update endpoint. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code and was published to the National Vulnerability Database (NVD) on June 12, 2026.

Critical Impact
Authenticated attackers with collection update rights can achieve remote code execution on ChromaDB servers, compromising the database host and any AI pipeline data it processes.

Affected Products

ChromaDB Python package version 0.4.17 and later
Self-hosted ChromaDB deployments exposing the v2 collections API
AI and RAG workloads relying on ChromaDB for vector storage

Discovery Timeline

2026-06-12 - CVE-2026-45833 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-45833

Vulnerability Analysis

The vulnerability resides in the ChromaDB collection update endpoint /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id}. An authenticated user with the UPDATE_COLLECTION permission can supply an arbitrary model repository as part of the collection configuration. When ChromaDB loads the supplied embedding model with trust_remote_code set to true, the Python runtime executes code shipped inside the attacker-controlled repository. Execution occurs in the context of the ChromaDB server process.

This pattern is well documented in machine learning loaders that rely on Hugging Face style AutoModel and AutoTokenizer calls. The trust_remote_code flag bypasses normal safety boundaries and runs custom Python modules referenced by the repository. ChromaDB exposes this dangerous flag through an authenticated API surface, turning a single low-privilege role into a server takeover primitive. The HiddenLayer advisory describes the issue and the affected endpoint in detail. See the HiddenLayer Security Advisory for the full disclosure.

Root Cause

The root cause is unsafe handling of user-controlled model identifiers combined with the trust_remote_code=true setting during collection updates. ChromaDB trusts the model repository value supplied by an authenticated tenant user and loads it without sandboxing or validation against an allowlist.

Attack Vector

The attack vector is network based and requires authentication with the UPDATE_COLLECTION permission. An attacker hosts a malicious model repository containing Python payload code. The attacker then issues an authenticated update request against the target collection endpoint, supplying the malicious repository and trust_remote_code=true. The ChromaDB server fetches and executes the repository code, granting the attacker arbitrary code execution under the server process.

Detection Methods for CVE-2026-45833

Indicators of Compromise

Outbound network connections from ChromaDB hosts to unexpected model repository domains or arbitrary Git endpoints.
Authenticated PUT or PATCH requests to /api/v2/tenants/*/databases/*/collections/{collection_id} containing non-standard model repository values.
Child processes spawned by the ChromaDB Python interpreter that download code, run shells, or modify cron and systemd units.
New files written under cache directories such as ~/.cache/huggingface/modules/ containing custom Python modules.

Detection Strategies

Inspect ChromaDB access logs for collection update calls that include trust_remote_code set to true or remote repository identifiers.
Correlate ChromaDB process activity with outbound network traffic to identify model downloads followed by subprocess execution.
Audit ChromaDB role assignments for accounts holding UPDATE_COLLECTION and review their recent API activity for anomalous patterns.

Monitoring Recommendations

Enable verbose API logging on ChromaDB and ship logs to a centralized analytics platform for retention and search.
Alert on any process descended from the ChromaDB service that launches python, sh, bash, curl, or wget.
Track file integrity on Hugging Face cache and ChromaDB persistence directories to catch dropped payloads.

How to Mitigate CVE-2026-45833

Immediate Actions Required

Upgrade ChromaDB to a patched release as published by the maintainers and tracked in the HiddenLayer Security Advisory.
Remove the UPDATE_COLLECTION permission from any account that does not require it, and rotate API tokens for tenants that previously held the role.
Restrict network egress from ChromaDB hosts so they cannot fetch arbitrary model repositories from the public internet.
Review collection metadata for unexpected model repository values and reset affected collections to known-good configurations.

Patch Information

The vendor advisory from HiddenLayer documents the fix and affected versions starting at 0.4.17. Operators should consult the HiddenLayer Security Advisory and the official ChromaDB release notes to identify the fixed version and upgrade path. After patching, audit running deployments to confirm the patched build is loaded by all replicas.

Workarounds

Disable or block API paths that allow modifying the embedding function or model repository until the patch is deployed.
Place ChromaDB behind a reverse proxy that strips trust_remote_code parameters from inbound update requests.
Run ChromaDB inside a hardened container with no outbound internet access and a read-only filesystem outside data volumes.
Pin embedding models to an internal allowlist served from a private registry rather than user-supplied repositories.

bash

# Configuration example: block trust_remote_code at the proxy layer
# Example NGINX snippet to drop dangerous parameters before reaching ChromaDB
location /api/v2/tenants/ {
    if ($request_body ~* "trust_remote_code\"\s*:\s*true") {
        return 403;
    }
    proxy_pass http://chromadb_upstream;
}