Read the docs

chroma-core

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

chroma-core records in CISA KEV

No chroma-core vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-62523 CVE-2026-92782 · GHSA-j8fq-8cc8-m22c

Chroma through 1.5.9 Authorization Bypass via Collection Identifier

Priority HIGH 72

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00448 Published 2026-09-16 No fix listed CWE-863
TI-2026-58776 CVE-2026-85664 · GHSA-3q9g-fh5w-hp67

Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustion

Priority MEDIUM 45

Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00658 Published 2026-09-04 No fix listed CWE-770
Open these records in search →