CVE-2026-45833

[CVE catalog]

Severity

Critical · CVSS 9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jun 12, 2026, 3:16:33 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.34% · Oct 25, 2026

A flaw was found in the ChromaDB Python project. An authenticated attacker with UPDATE_COLLECTION permission could exploit a code injection vulnerability. By sending a malicious model repository to a specific API endpoint with trust_remote_code enabled, the attacker can execute arbitrary code on the server. This could lead to a complete compromise of the affected system. chromadb: ChromaDB: Arbitrary Code Execution via Code Injection This is a post-authentication ChromaDB FastAPI flaw: exploitation requires a valid user with UPDATE_COLLECTION and a crafted request that sets trust_remote_code: true on a malicious HuggingFace model. It is not unauthenticated remote code execution. RH AI products ship a vulnerable chromadb version but do not expose the Chroma FastAPI API as the default product surface. RHOAI AutoRAG uses Llama Stack with Milvus/pgvector; RHEL AI bootc images include chromadb as a library dependency, not a network-facing Chroma server. Without a customer or misconfiguration that runs and exposes the Chroma Python server to untrusted users, the upstream attack path is not reachable. Upstream CVSS 9.4 Critical assumes network access to Chroma’s API with exploitable permissions. That does not match default RHOAI/RHEL AI architecture, so Important is the appropriate RH impact. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.