CVE-2026-92782: Chroma Authorization Bypass Vulnerability

CVE-2026-92782 Overview

CVE-2026-92782 is an authorization bypass vulnerability in Chroma, an open-source vector database used in retrieval-augmented generation (RAG) and AI application pipelines. Chroma versions through 1.5.9 fail to validate tenant and database segments when resolving collections. Authenticated attackers who know a collection identifier can access, read, modify, and update records in collections owned by other tenants. The attacker issues requests under their own tenant path, and the server resolves the collection without confirming ownership. This breaks multi-tenant isolation and directly exposes vector data and embeddings stored in foreign tenants.

Critical Impact
Any authenticated tenant can access and modify data in any other tenant's collection given only the collection identifier, defeating multi-tenant isolation in Chroma deployments.

Affected Products

Chroma versions up to and including 1.5.9
Chroma frontend server component (rust/frontend/src/server.rs)
Chroma collection resolver (get_collection_with_segments_provider.rs)

Discovery Timeline

2026-09-16 - CVE-2026-92782 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92782

Vulnerability Analysis

The flaw is an authorization weakness classified as [CWE-863] Incorrect Authorization. Chroma exposes collection operations under tenant and database path segments, giving the appearance of tenant-scoped access control. However, the collection resolver looks up collections by identifier without verifying that the resolved collection actually belongs to the tenant and database supplied in the request path. Because collection identifiers are the sole trust boundary, any authenticated user who obtains or guesses a collection identifier for another tenant can operate on it as if it were their own.

Successful exploitation results in unauthorized read access to embeddings and metadata, silent modification of vector records, and tampering with downstream AI pipelines that consume the collection. In RAG deployments, this can be leveraged to poison retrieval results or exfiltrate proprietary embeddings.

Root Cause

The root cause is missing tenant and database validation in the collection lookup path. The relevant logic in rust/frontend/src/get_collection_with_segments_provider.rs (lines 143-160) and rust/frontend/src/server.rs (lines 469-487) resolves collections by identifier alone. The tenant and database segments in the request URL are accepted but not compared against the collection's actual owning tenant and database.

Attack Vector

The attack is executed over the network by an authenticated Chroma user. The attacker crafts an HTTP request that references a target collection identifier belonging to another tenant, but places the attacker's own tenant and database name in the path segments. The Chroma server resolves the collection by identifier and executes the requested operation, whether read, add, update, or delete, against the foreign tenant's data.

The vulnerability manifests in the collection resolution logic and requires no unusual conditions beyond a valid authenticated session. See the VulnCheck Advisory on Chroma and the Chroma Core GitHub Issue #7462 for the technical writeup and reproduction details.

Detection Methods for CVE-2026-92782

Indicators of Compromise

Requests where the tenant or database segment in the URL path does not correspond to the tenant that owns the referenced collection identifier.
Unexpected add, update, upsert, or delete operations against collections from client identities that historically only accessed a different tenant.
Access patterns where a single authenticated principal touches collection identifiers spanning multiple tenants within a short time window.

Detection Strategies

Enable and centralize Chroma frontend access logs, then correlate the tenant path segment with the owning tenant of each accessed collection identifier.
Alert on any request where the requesting principal's tenant does not match the collection's owning tenant.
Baseline normal per-tenant collection identifier usage and flag deviations, such as identifiers never previously seen from a given tenant.

Monitoring Recommendations

Forward Chroma HTTP access logs and application logs into a centralized analytics platform such as Singularity Data Lake for cross-tenant correlation and retention.
Monitor egress volumes from Chroma nodes for spikes consistent with bulk embedding exfiltration.
Track write operations against high-value collections and require review of any writes originating from unexpected tenants or service accounts.

How to Mitigate CVE-2026-92782

Immediate Actions Required

Restrict network access to Chroma frontend endpoints so only trusted application services can reach them.
Rotate and tighten authentication tokens, and remove shared credentials that grant access across multiple tenants.
Audit existing collections to determine whether unauthorized cross-tenant access or modification has already occurred.
Treat collection identifiers as sensitive values and avoid exposing them in client-side code, logs, or shared documentation.

Patch Information

No fixed version was listed in the NVD entry at the time of publication. Chroma users running versions up to and including 1.5.9 should track the Chroma Core GitHub Repository and Chroma Core GitHub Issue #7462 for a patched release and upgrade as soon as one is available.

Workarounds

Deploy a reverse proxy or API gateway in front of Chroma that enforces per-tenant authorization and rejects any request where the authenticated principal's tenant does not match the tenant segment in the URL.
Run separate Chroma instances per tenant where feasible, eliminating shared multi-tenant collection namespaces.
Enforce network segmentation and mutual TLS between application services and Chroma so untrusted clients cannot reach collection endpoints directly.
Randomize and treat collection identifiers as secrets, reducing the risk of identifier guessing or leakage.