TI-2026-33557 Aliases CVE-2026-45832 GHSA-x97m-f58v-9cwg

Authorization bypass in ChromaDB

MEDIUM 40CWE-639Published 2026-06-12 · Updated 2026-07-31

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Will not fix Red Hat: no fix planned

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-639.

Summary

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00284 20th percentileScored 2026-11-07

Fix Will not fix Red Hat: no fix planned

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Chroma	ChromaDB	0.5.0 and later	—	No fix listed	CNA

ChromaDB VendorChroma Affected 0.5.0 and later Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:trychroma:chromadb::::::python::*	0.5.0 – 1.5.9	Vulnerable	Chroma

cpe:2.3:a:trychroma:chromadb:*:*:*:*:*:python:*:* Versions 0.5.0 – 1.5.9 Vulnerable ·Chroma

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix planned: Will not fix

Not affected: 1 product

Red Hat OpenShift AI (RHOAI)

Timeline

2026-10-02 Threatist record created from CVE-2026-45832
2026-10-03 Alias added: GHSA-x97m-f58v-9cwg

References

Advisory 1

https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-4

TI-2026-33558 Code injection in ChromaDB CVSS 4.0CRITICAL 9.4
TI-2026-33556 Incorrect authorization in ChromaDB CVSS 4.0HIGH 8.8
TI-2026-33555 Authorization bypass in ChromaDB CVSS 4.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences