A pre-authentication

CVE-2026-45829 is a pre-auth remote code execution flaw in the ChromaDB Python FastAPI server. On chromadb versions >= 1.0.0 and <= 1.5.9, the create_collection flow builds an attacker-controlled embedding function before it performs the auth check. If the attacker sets kwargs.trust_remote_code=true and points model_name at a malicious Hugging Face-style repository, Chroma fetches and executes that code inside the server process. The Rust deployment path is not affected.

In a vacuum this looks like a straight CRITICAL: network-reachable, no auth, no user interaction, code exec. In real estates, the severity comes down one notch because the blast population is narrower than the raw bug suggests: you need the Python backend, not the Rust one; you need the API to be reachable from the attacker; and many enterprises do not expose their vector stores broadly. But if you *do* run exposed Python Chroma, the vendor-less score inflation debate is academic — it is still a serious server takeover path.

Why this verdict

• Network-reachable pre-auth RCE: no credentials, no user interaction, and code runs before auth enforcement on the vulnerable Python path.
• Population narrowed by deployment choice: the Rust deployment path is not affected, so this is not a whole-product emergency across every Chroma install.
• Exposure is the make-or-break prerequisite: requiring HTTP reachability to the API means private-only or tightly segmented deployments are materially safer than internet-exposed ones.
• No vendor-maintainer fixed release as of 2026-05-31: lack of an official patch increases operational risk because mitigation has to carry the load.
• Low EPSS and no KEV: current exploitation telemetry is weak, which argues against a top-bucket CRITICAL fleet-wide panic score.

Why not higher?

I am not calling this CRITICAL fleet-wide because the real-world reachable population is smaller than the naked bug suggests. You need the vulnerable Python server path, not Rust, and you need attacker reachability to the API; those are meaningful friction points when you are triaging across 10,000 hosts rather than staring at a single exposed AI service.

Why not lower?

I am not dropping this to MEDIUM because once the prerequisites are met, the exploit chain is brutally short and the impact is full server compromise. Pre-auth code execution against an exposed service is still the kind of bug that becomes a breach, not a nuisance.

1. Remove untrusted network reachability — Put every affected Python Chroma API behind a private network boundary, VPN, service mesh policy, or IP allowlist. For a HIGH verdict, deploy this within 30 days; this is the single most effective compensating control because the exploit starts with plain HTTP reachability.
2. Front Chroma with an auth-enforcing reverse proxy — Terminate requests at a gateway that performs authentication and authorization *before* traffic reaches the Python FastAPI service. Deploy within 30 days and validate that unauthenticated requests never reach /api/v2/tenants/.../collections.
3. Block model-registry egress from the service — Deny outbound access from Chroma containers/hosts to Hugging Face and other unapproved artifact sources, except through a vetted internal mirror if the workflow truly requires it. Deploy within 30 days; this directly breaks the remote-model fetch stage of the exploit.
4. Prefer the Rust deployment path — If you must keep Chroma online before a vendor-confirmed Python fix exists, migrate exposed workloads to the Rust-based deployment path, which public research says is not affected. Treat this as a compensating architecture change and complete it within 30 days for internet-facing or broadly reachable services.
5. Watch for suspicious collection creation and host behavior — Alert on POSTs to collection-creation endpoints, unexpected model loads, outbound fetches to model registries, and new process/file activity under the Chroma service account. Deploy within 30 days; this will not prevent exploitation, but it improves time-to-detect.

Run this on the target host, container, or image where chromadb is installed. Invoke it with python3 verify_cve_2026_45829.py using the same Python environment that runs Chroma; no admin rights are required, but you do need filesystem access to the installed package. The script performs a static package inspection and prints exactly one of VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# verify_cve_2026_45829.py
# Static verifier for CVE-2026-45829 in the ChromaDB Python package.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import importlib
import importlib.util
import os
import re
import sys
from pathlib import Path

VULN_MIN = (1, 0, 0)
VULN_MAX = (1, 5, 9)


def parse_version(v):
    if not v:
        return None
    nums = re.findall(r"\d+", str(v))
    if not nums:
        return None
    parts = [int(x) for x in nums[:3]]
    while len(parts) < 3:
        parts.append(0)
    return tuple(parts)


def read_text(p):
    try:
        return Path(p).read_text(encoding="utf-8", errors="ignore")
    except Exception:
        return ""


def main():
    try:
        chromadb = importlib.import_module("chromadb")
    except Exception:
        print("UNKNOWN")
        sys.exit(2)

    version = getattr(chromadb, "__version__", None)
    vtuple = parse_version(version)

    pkg_dir = Path(getattr(chromadb, "__file__", "")).resolve().parent
    if not pkg_dir.exists():
        print("UNKNOWN")
        sys.exit(2)

    fastapi_file = pkg_dir / "server" / "fastapi" / "__init__.py"
    collcfg_file = pkg_dir / "api" / "collection_configuration.py"
    sentxf_file = pkg_dir / "utils" / "embedding_functions" / "sentence_transformer_embedding_function.py"

    fastapi_txt = read_text(fastapi_file)
    collcfg_txt = read_text(collcfg_file)
    sentxf_txt = read_text(sentxf_file)

    # Heuristic 1: vulnerable ordering in create_collection path.
    idx_load = fastapi_txt.find("load_create_collection_configuration_from_json")
    idx_auth = fastapi_txt.find("sync_auth_request")
    order_vuln = idx_load != -1 and idx_auth != -1 and idx_load < idx_auth

    # Heuristic 2: attacker-controlled embedding config reaches known embedding functions.
    cfg_vuln = (
        'known_embedding_functions[ef_config["name"]]' in collcfg_txt and
        'build_from_config(ef_config["config"])' in collcfg_txt
    )

    # Heuristic 3: sentence transformer forwards kwargs to constructor, enabling trust_remote_code flow.
    kwargs_forwarded = (
        'kwargs = config.get("kwargs", {})' in sentxf_txt and
        '**kwargs' in sentxf_txt
    )

    # Heuristic 4: evidence of an obvious patch pattern.
    auth_before_load = idx_auth != -1 and idx_load != -1 and idx_auth < idx_load
    strips_kwargs = (
        'pop("kwargs"' in fastapi_txt or
        'del json_map["embedding_function"]["config"]["kwargs"]' in collcfg_txt or
        'trust_remote_code' in collcfg_txt and 'False' in collcfg_txt
    )

    in_version_range = vtuple is not None and VULN_MIN <= vtuple <= VULN_MAX

    if order_vuln and cfg_vuln and kwargs_forwarded and (in_version_range or version is None):
        print("VULNERABLE")
        sys.exit(1)

    if auth_before_load or strips_kwargs:
        print("PATCHED")
        sys.exit(0)

    # Version-only fallback: GitHub Advisory says <= 1.5.9 affected and patched versions are None.
    if in_version_range:
        print("VULNERABLE")
        sys.exit(1)

    print("UNKNOWN")
    sys.exit(2)


if __name__ == "__main__":
    main()

Sources

1. NVD CVE-2026-45829
2. HiddenLayer research: ChromaToast Served Pre-Auth
3. GitHub Advisory GHSA-f4j7-r4q5-qw2c
4. Chroma GitHub issue #6717
5. Chroma releases
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS data and stats
8. Hadrian analysis and nuclei fingerprint