Chroma: All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and…
Chroma
More for Chroma RSS feed for Chroma
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-45832
- Affects
- Chroma
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 12, 2026
- Source last modified
- October 26, 2026
Description
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.
Description quoted from the NVD record.
Who is affected
Chroma (also called ChromaDB) is a database that stores information so that AI tools can search it by meaning. This flaw affects the Python version of Chroma, in the older first-version connection points that programs use to work with collections of stored data. These connection points do not tell the permission checks which account or database a request belongs to, so an attacker can get around Chroma's access controls by using them. No specific affected versions are named for this flaw. This flaw is rated High.
What to do
- If someone in your organization installed or runs Chroma, that person should handle this. If an IT provider or vendor runs it for you, send them this advisory and ask when the update will be done.
- No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release.
- When a fixed release is available, install it on every copy of Chroma your organization runs.
- No workaround is named for this flaw, so check the vendor advisory linked on this page again for updates until a fix is installed.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.