CVE-2026-8828: ChromaDB Rust Auth Bypass Vulnerability

CVE-2026-8828 Overview

CVE-2026-8828 is an authorization bypass vulnerability affecting the ChromaDB Rust project, versions 1.0.0 and later. The flaw stems from missing tenant-scope validation during authenticated API requests. Any authenticated user can read, write, update, or delete data in collections owned by other tenants. This breaks the multi-tenant isolation model that ChromaDB deployments rely on to separate customer data. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key and was disclosed by HiddenLayer. ChromaDB is widely used as a vector database backing retrieval-augmented generation (RAG) and AI workloads, making the cross-tenant exposure relevant to AI infrastructure security.

Critical Impact
Any authenticated user can perform full read, write, update, and delete operations against any tenant's collections, breaking multi-tenant data isolation.

Affected Products

ChromaDB Rust project version 1.0.0
ChromaDB Rust project versions later than 1.0.0
Multi-tenant deployments of ChromaDB Rust serving AI and vector search workloads

Discovery Timeline

2026-06-12 - CVE-2026-8828 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2026-8828

Vulnerability Analysis

The ChromaDB Rust server exposes collection operations scoped to a tenant and database. When a request arrives with valid authentication, the server identifies the caller but does not verify that the caller's identity is authorized for the target tenant referenced in the request path or parameters. Authentication and authorization are conflated. Possession of any valid credential becomes sufficient to operate on any tenant's collection.

This class of flaw, mapped to CWE-639, is also known as Insecure Direct Object Reference (IDOR). Tenant identifiers act as user-controlled keys. The server treats them as trusted input rather than validating them against the caller's session context.

The impact extends beyond confidentiality. An attacker can overwrite embeddings, inject poisoned vectors, or delete entire collections belonging to other tenants. In RAG pipelines this enables data poisoning that influences downstream large language model (LLM) outputs.

Root Cause

The ChromaDB Rust codebase lacks an authorization check that binds the authenticated principal to the tenant scope of the request. The HiddenLayer advisory documents the missing validation in the request handling path. See the HiddenLayer Security Advisory for the specific code paths.

Attack Vector

The attack vector is network-based and requires only low-privilege authenticated access. An attacker logged in as any tenant submits standard ChromaDB API requests targeting a different tenant identifier. The server processes the request without rejecting the cross-tenant reference. No user interaction or specialized tooling is needed beyond the documented ChromaDB API.

No verified exploit code is publicly available. The vulnerability is described in prose in the linked advisory.

Detection Methods for CVE-2026-8828

Indicators of Compromise

API requests where the authenticated principal's tenant identifier differs from the tenant identifier in the request path or body
Unexpected create, update, or delete operations against collections that have never been accessed by the calling identity before
Sudden changes in embedding counts, collection metadata, or document content in tenants that have no scheduled write activity
Authentication tokens issued for one tenant appearing in requests targeting collections owned by another tenant

Detection Strategies

Enable request logging on the ChromaDB Rust service and compare the tenant claim in the auth context with the tenant path parameter on every request
Alert on any mismatch between the caller's tenant scope and the target tenant in the URL or JSON payload
Baseline normal per-tenant write and delete volumes, then alert on deviations that correlate with cross-tenant request patterns
Review historical access logs since the deployment of ChromaDB Rust 1.0.0 for retroactive evidence of cross-tenant access

Monitoring Recommendations

Forward ChromaDB application and access logs to a centralized logging platform with retention sufficient to cover the exposure window
Monitor administrative API endpoints handling collection creation, deletion, and embedding upserts for unusual caller patterns
Track service account and API key usage per tenant and flag identities that touch multiple tenants within short time windows

How to Mitigate CVE-2026-8828

Immediate Actions Required

Identify all running instances of the ChromaDB Rust project at version 1.0.0 or later and inventory their tenants and collections
Restrict network access to the ChromaDB API to trusted application tiers only until a fix is applied
Rotate API keys and authentication credentials that may have been used to exercise cross-tenant access
Audit collection contents and embeddings for unexpected modifications, additions, or deletions

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Refer to the HiddenLayer Security Advisory and the upstream ChromaDB Rust project repository for the current patch status and recommended upgrade version.

Workarounds

Deploy a single tenant per ChromaDB Rust instance to eliminate cross-tenant exposure at the application layer
Place an authorizing reverse proxy in front of ChromaDB that validates the caller's tenant claim against the tenant referenced in the request path before forwarding
Issue tenant-bound credentials at the network level and use per-tenant network segmentation so that one tenant's clients cannot reach another tenant's ChromaDB endpoint
Disable shared multi-tenant deployments until an authorized patched build is available

bash

# Example reverse proxy rule (nginx) to reject cross-tenant requests
# Requires the upstream auth layer to set X-Auth-Tenant from a verified token
location ~ ^/api/v[0-9]+/tenants/(?<req_tenant>[^/]+)/ {
    if ($http_x_auth_tenant != $req_tenant) {
        return 403;
    }
    proxy_pass http://chromadb_upstream;
}