chromadb
PyPI4 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting chromadbpage 1 of 1
- CVE-2026-45829CRITICALCVSS 10.0EG 10.02026-05-18
vulnerable: 1.0.0 ... 1.5.9 (44 versions)
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_cod…
- CVE-2026-45830HIGHCVSS 8.8EG 8.82026-06-12
vulnerable: 0.4.17 ... 1.5.9 (76 versions)
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belon…
- CVE-2026-45831HIGHCVSS 8.8EG 8.82026-06-12
vulnerable: 0.5.0 ... 1.5.9 (68 versions)
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission a…
- CVE-2026-45833HIGHCVSS 8.8EG 8.82026-06-12
vulnerable: 0.4.17 ... 1.5.9 (76 versions)
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the�…
Check whether chromadb is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for chromadb CVEs against the assets you own.
Start Free Scan →