chromadb has 4 CVEs on record. The busiest recent month was June 2026 with 3. The median CVSS is 8.8 (high), with 2 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —
- Last 90 days
- 0 prev 4
Worst active — by depth score
CVE-2026-45829Critical· 10.0A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_c…70CVE-2026-45833CriticalChromaDB has a code injection vulnerability64CVE-2026-45831High· 8.8ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to48CVE-2026-45830High· 8.8ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection48
chromadb vulnerabilities
CVEs affecting chromadb, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-45831High· 8.8ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to
ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to
CVE-2026-45833CriticalPoCChromaDB has a code injection vulnerability
ChromaDB has a code injection vulnerability
CVE-2026-45830High· 8.8ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection
ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection
CVE-2026-45829Critical· 10.0PoCA pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_c…
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_c…