概要
CVE-2026-45829 affects ChromaDB's Python FastAPI backend, not the default Rust frontend. That distinction matters: a generic Chroma API or version response can describe an unaffected Rust service, so useful coverage must identify the frontend as well as the release.
仕組み
The advisory describes attacker-controlled embedding-function configuration being processed before authorization. The affected surface is the optional Python service implementation; the default Rust frontend follows a different path and is not covered by the advisory.
被害範囲
If the identified Python backend is reachable from an untrusted network, the advisory describes pre-authentication code execution with the server process privileges. A finding should trigger urgent frontend migration, exposure restriction, log review, and secret-impact assessment, while remaining a version-based advisory rather than proof that code ran.
// fixvibeのチェック内容
FixVibeのチェック内容
FixVibe maps externally visible application surfaces with passive signals and safe metadata checks. Reports summarize the exposed surface and remediation priorities. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
鉄壁の防御
Move the service to Chroma's supported Rust-based deployment path or a vendor-confirmed patched Python release. Block untrusted access before it reaches ChromaDB, restrict unnecessary outbound model-registry access, and review ChromaDB and host logs, environment variables, mounted credentials, and process activity if the Python backend was exposed.