CVE-2026-45829

CriticalCVSS 10.0/10Last modified Oct 26, 2026

Description

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94 CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Chroma	ChromaDB	>= 1.0.0, <= *
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—

References

Timeline

Published: May 18, 2026
Last modified: Oct 26, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-45835.0A vulnerability was detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this issue is some unknown functionality of the co CVE-2026-458308.8A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily r CVE-2026-458318.8The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a use CVE-2026-458328.8All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing at CVE-2026-458338.8A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary c CVE-2026-458345.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() A CVE-2026-458355.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() CVE-2026-458365.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() A CVE-2026-458377.8In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in arena_vm_close on fork arena_vm_open() only CVE-2026-458385.5In the Linux kernel, the following vulnerability has been resolved: bpf: fix end-of-list detection in cgroup_storage_get_next_key() list_n CVE-2026-458397.8In the Linux kernel, the following vulnerability has been resolved: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() C CVE-2026-45843.1A flaw has been found in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. This affects an unknown part of the component Cardholder Data Handler