What happened
CVE-2026-45829 is a critical vulnerability in ChromaDB's optional Python FastAPI server. A collection request can supply embedding-function configuration that refers to remote model code, and the affected Python backend can initialize that configuration before authorization completes [S1][S2][S3]. ChromaDB's default Rust frontend does not use the affected Python path and is not covered by this advisory [S2][S3].
Impact and prerequisites
Exploitation requires a deployment that actually runs the Python FastAPI backend, accepts requests from an untrusted source, and can process attacker-controlled collection and embedding-function configuration. If those conditions are met, the advisory describes code execution with the ChromaDB server process privileges [S1][S3].
The CNA record lists ChromaDB 1.0.0 and later as affected [S1]. At the time of this review, the public research did not identify a vendor-confirmed patched Python release, and the official package registry listed 1.5.9 as the newest stable release [S3][S4]. That does not make every ChromaDB deployment vulnerable: the default Rust frontend is outside the affected path [S2][S3].
Concrete fixes
- Move to the Rust server. Use Chroma's supported Rust-based server path, such as
chroma runor the supported Rust-backed container deployment [S2][S3]. - Restrict service exposure. Require trusted-network, VPN, SSO, or authenticated reverse-proxy access before requests reach ChromaDB. Do not rely on hiding one API route.
- Restrict outbound access. Limit unnecessary egress from the ChromaDB service to public model registries and code-hosting services.
- Review possible exposure. If the Python backend was reachable from an untrusted network, review ChromaDB access logs, unexpected model downloads, process and host activity, environment variables, mounted credentials, and reachable data.
- Validate future Python fixes. If you remain on the Python backend, deploy only a vendor-confirmed patched release or supported backport and verify the running process, image, and package inventory.
Covered by FixVibe
FixVibe covers this advisory with a read-only check that runs only for verified active-scan targets. It identifies the relevant ChromaDB Python deployment and correlates its release information with the reviewed advisory data. The check does not create or modify ChromaDB resources, provide a model repository, enable remote-code trust, trigger model downloads, test authorization bypass, or execute code.
A finding is a version-based advisory. Customers see the detected service, backend and release context, confidence, source references, prerequisites, and remediation guidance. It is not proof that authorization was bypassed, a remote model was loaded, or code executed. Private backports, forks, stale service metadata, and intermediaries that reproduce the upstream API can require operator confirmation.