Vulnerability Description
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.
CVSS Score
8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Trychroma | Chromadb | >= 0.5.0, <= 1.5.9 |
Related Weaknesses (CWE)
References
- https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-4Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-45832
- https://bugzilla.redhat.com/show_bug.cgi?id=2488411
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45832.json
FAQ
What is CVE-2026-45832?
CVE-2026-45832 is a vulnerability with a CVSS score of 8.8 (HIGH). All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 end...
How severe is CVE-2026-45832?
CVE-2026-45832 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45832?
Check the references section above for vendor advisories and patch information. Affected products include: Trychroma Chromadb.