CVE-2026-45829

[CVE catalog]

Severity

Critical · CVSS 10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

May 18, 2026, 3:59:22 PM UTC

Source

[NVD] · [CVE record]

EPSS

15.15% · Oct 27, 2026

A flaw was found in the ChromaDB Python project. This pre-authentication code injection vulnerability allows an unauthenticated attacker to execute arbitrary code on the server. The attacker can achieve this by sending a malicious model repository to the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint, provided that trust_remote_code is set to true. This could lead to complete compromise of the affected system. chromadb: ChromaDB Python Project: Arbitrary code execution via pre-authentication code injection The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.