10

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45829

CVE-2026-45829: ChromaDB Python project has a pre-authentication code injection vulnerability

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45829

CVE-2026-45829:

10

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
chromadb	pip	>= 1.0.0, <= 1.5.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a pre-authentication remote code execution flaw in the ChromaDB Python server. It stems from two main issues that, when combined, are critical. First, the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint, handled by the create_collection function, processes user-supplied collection configurations before authenticating the request. Second, the server allows users to specify custom embedding functions and their configurations. An attacker can exploit this by crafting a request that specifies a SentenceTransformerEmbeddingFunction with a malicious model from HuggingFace and sets the trust_remote_code parameter to true. The load_create_collection_configuration_from_json function will process this configuration, and the SentenceTransformerEmbeddingFunction.build_from_config method will insecurely pass the trust_remote_code flag to the HuggingFace model loader. This causes the server to download and execute arbitrary code from the malicious model repository. Because the authentication check happens after the model is loaded and executed, an unauthenticated attacker can gain full control of the server process.

Vulnerable functions

FastAPI.create_collection

chromadb/server/fastapi/__init__.py

This API endpoint handler is the entry point for the vulnerability. It incorrectly processes user-provided collection configuration, which may contain a malicious embedding function, before it performs authentication checks. This allows an unauthenticated attacker to trigger the code injection.

load_create_collection_configuration_from_json

chromadb/api/collection_configuration.py

This function is responsible for parsing the user-provided JSON configuration. It dynamically instantiates an embedding function based on the configuration. When a malicious configuration is provided, this function calls `build_from_config` on the specified embedding function class, which leads to the execution of untrusted code.

SentenceTransformerEmbeddingFunction.build_from_config

chromadb/utils/embedding_functions/sentence_transformer_embedding_function.py

This function constructs a `SentenceTransformerEmbeddingFunction` instance from a configuration dictionary. It insecurely passes all keyword arguments (`kwargs`) from the user-controlled configuration to the underlying model loading function. This allows an attacker to set `trust_remote_code=True`, which enables remote code execution when loading a malicious model from HuggingFace.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.