Loading story…
A maximum-severity remote code execution flaw in ChromaDB's Python FastAPI server, tracked as CVE-2026-45829, allows unauthenticated attackers to take over exposed instances by abusing an API endpoint that fetches and executes attacker-controlled model code from Hugging Face before authentication is enforced. HiddenLayer, which disclosed the issue under the name ChromaToast Served Pre-Auth, reported the bug to ChromaDB after finding that the vulnerable server-side code was introduced in version 1.0.0 and remained present through at least 1.5.8, with the status of 1.5.9 unclear.
The exposure is significant for AI application environments using ChromaDB as a vector database: HiddenLayer said about 73% of internet-exposed Chroma instances identified via Shodan appeared to be running vulnerable versions. Deployments using ChromaDB locally without exposing the API server, or using the Rust front-end instead of the Python server, are not affected. Recommended mitigations include removing public access to the Python API server, restricting network access to the ChromaDB port, preferring the Rust front-end where possible, and scanning machine learning model artifacts before runtime.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer reported that CVE-2026-45829 remained unpatched in ChromaDB version 1.5.8, with uncertainty around whether version 1.5.9 fixed it. The report highlighted HiddenLayer's estimate that about 73% of internet-exposed Chroma instances found via Shodan were running vulnerable versions and recommended limiting exposure or using the Rust frontend.
HiddenLayer publicly disclosed research on the ChromaDB vulnerability, describing a pre-authentication remote code execution issue in exposed Python API server deployments. The disclosure noted the issue affected server code introduced in version 1.0.0 and that many internet-exposed instances appeared vulnerable.
HiddenLayer reported CVE-2026-45829 to ChromaDB on 2026-02-17. The flaw affects ChromaDB's Python FastAPI server and can allow unauthenticated remote code execution via attacker-controlled model code loaded from Hugging Face before authentication is enforced.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcescworld.com
Open sourcethecyberexpress.com
Open sourcebleepingcomputer.com
Open sourcehiddenlayer.com
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported two **high-severity vulnerabilities** in the open-source AI chatbot framework **Chainlit** that could enable sensitive data exposure and, in some environments, broader cloud compromise. The issues—**CVE-2026-22218** (arbitrary file read) and **CVE-2026-22219** (server-side request forgery, SSRF)—were described as “easy-to-exploit” and particularly risky because Chainlit-based applications are often deployed internet-facing and integrated with other enterprise services (for example, via common AI tooling and cloud backends). Technical details indicate CVE-2026-22218 can be triggered via a malicious element update request using a tampered custom element, allowing attackers to read files such as `/proc/self/environ` and potentially exfiltrate environment variables containing **API keys, credentials, and other secrets**. CVE-2026-22219 could allow SSRF against servers hosting AI applications, creating a path to access internal resources. Zafran reported responsible disclosure to maintainers in November and stated it had not observed in-the-wild exploitation; Chainlit released **version 2.9.4** to address both flaws, and organizations running Chainlit were advised to update to the patched release.
Jun 29, 2026
A critical remote code execution flaw, **`CVE-2026-61447`**, was disclosed in the PraisonAI AI agent framework, affecting versions before **`1.6.78`**. The vulnerability lies in **`CodeAgent._execute_python()`**, which executes LLM-generated Python without AST validation, import restrictions, or sandbox enforcement, allowing attackers to use prompt injection to make the agent run arbitrary code on the host. The issue received the maximum severity rating of **CVSS 10.0** under both v3.1 and v4.0. Successful exploitation can result in full host compromise and theft of sensitive data, including API keys, cloud credentials, database passwords, and other environment secrets, with potential pivoting into connected services. PraisonAI **`1.6.78`** fixes the issue, and defenders are being urged to upgrade immediately, reduce network exposure, rotate potentially exposed secrets, and monitor for anomalous outbound connections; no confirmed in-the-wild exploitation had been reported at disclosure time.
Jul 11, 2026
A critical remote code execution (RCE) vulnerability, tracked as CVE-2025-49655, has been identified in the Keras machine learning framework, specifically affecting versions 3.11.0 up to but not including 3.11.3. The flaw arises from unsafe deserialization of untrusted data within the TorchModuleWrapper class, which can be exploited when a maliciously crafted Keras file is loaded. This vulnerability allows attackers to execute arbitrary code on the victim's system, even if Keras is running in safe mode, significantly increasing the risk profile for users who routinely load external or shared model files. The issue can be triggered through both local and remote files, making it exploitable in a variety of deployment scenarios, including cloud-based and on-premises environments. The vulnerability has been assigned a CVSS v3.1 base score of 9.8, categorizing it as critical due to the ease of exploitation and the potential impact. Security researchers have highlighted that the attack does not require authentication, and exploitation can occur simply by loading a malicious model file. The vulnerability was publicly disclosed in October 2025, with security advisories urging immediate action. At the time of disclosure, the affected product versions were clearly identified, but some databases had not yet listed all impacted vendors or products. The Keras development team has released a patch in version 3.11.3 to address the issue, and users are strongly advised to upgrade to this version or later. Organizations using Keras in production or research environments should audit their model loading workflows and restrict the use of untrusted model files. The vulnerability underscores the broader risks associated with deserialization flaws in machine learning frameworks, which are increasingly targeted due to their widespread adoption. Security teams are encouraged to monitor for suspicious activity related to model file handling and to implement additional controls where feasible. The incident has prompted renewed calls for secure coding practices and rigorous input validation in AI and machine learning software. The rapid response from the Keras maintainers has been noted, but the incident serves as a warning for similar frameworks to review their own deserialization logic. The vulnerability's critical rating reflects both the technical severity and the potential for widespread exploitation if left unaddressed. Industry experts recommend that all organizations using Keras review their current deployments and apply the necessary updates without delay. The disclosure of CVE-2025-49655 has also led to increased scrutiny of third-party model sharing platforms, which may inadvertently distribute malicious files. This event highlights the importance of maintaining up-to-date software and following best practices for secure machine learning operations.
Jun 29, 2026