CVE-2026-45832

[CVE catalog]

Severity

High · CVSS 8.8CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jun 12, 2026, 3:11:46 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.28% · Oct 25, 2026

A flaw was found in ChromaDB. All V1 collection-level endpoints in the Python project pass null values for tenant and database to the authorization layer. This allows a remote attacker to bypass authorization controls by utilizing these V1 endpoints. The primary consequence is unauthorized access, potentially leading to high impact on confidentiality and integrity of data. chromadb: ChromaDB: Authorization bypass in V1 collection-level endpoints This flaw is a post-authentication tenant-isolation bypass on ChromaDB’s V1 API — it does not grant unauthenticated access and does not enable code execution. RH AI products bundle a vulnerable chromadb version but do not run the Chroma Python FastAPI server as the default product API (AutoRAG uses Milvus/pgvector; RHEL AI bootc uses chromadb as a library). The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.