Pre-auth RCE in ChromaDB Python FastAPI collection creation endpoint
CVE-2026-45829 is a pre-authentication code injection / remote code execution vulnerability in the Python FastAPI implementation of ChromaDB, affecting version 1.0.0 or later and reported as present through 1.5.8. The flaw is in the collection creation API path, including /api/v2/tenants/{tenant}/databases/{db}/collections, where attacker-controlled embedding function configuration is processed before authentication is enforced. An unauthenticated attacker can submit a crafted request that specifies an attacker-controlled Hugging Face model repository and sets trust_remote_code=true. ChromaDB then loads the model and executes remote Python code from that repository before the authentication check completes. The root cause is that client-supplied model-loading parameters are forwarded into embedding/model loading logic prior to auth validation, enabling arbitrary code execution in the ChromaDB server process.
Impact, mitigation & remediation
What it means. What to do now. For analysts and engineers who need to decide and keep moving.
Impact
What an attacker gets — and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a functional Python proof-of-concept exploit for CVE-2026-45829 targeting ChromaDB Python deployments. The main script, cve_2026_45829_poc.py, checks the target version via /api/v2/version and then sends a POST request to /api/v2/tenants/{tenant}/databases/{database}/collections with crafted metadata that specifies a Hugging Face embedding model and sets trust_remote_code=true. The intended effect is to make the target fetch and execute attacker-controlled Python code from a remote model repository before authentication is enforced, yielding pre-auth RCE. The exploit treats HTTP 500 as a likely success condition because model loading may already have occurred even if auth later fails. The repository also includes a separate safe detection script that only checks the version endpoint, a simple Python reverse-shell listener binding to 0.0.0.0:4444 for post-exploitation interaction, and short text files for execution instructions, mitigation guidance, and references. Overall purpose: demonstrate and operationalize unauthenticated remote code execution against vulnerable ChromaDB versions 1.0.0 through 1.5.8 by abusing remote model loading from Hugging Face.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles against your asset inventory in the product.
Recent activity
18 sources tracked across advisories, community write-ups, and news. Mallory keeps watching after this page renders.
A critical unauthenticated remote code execution vulnerability in the Python FastAPI version of ChromaDB that allows attackers to trigger loading and execution of a malicious model before authentication is enforced.
An unauthenticated remote code execution vulnerability in the ChromaDB FastAPI server caused by processing user-controlled embedding function configuration before authentication, allowing attacker-controlled HuggingFace model loading with trust_remote_code enabled.
A maximum-severity unauthenticated remote code execution vulnerability in the Python FastAPI server component of ChromaDB, caused by model settings being processed before authentication checks, allowing attackers to load and execute a malicious Hugging Face model.
A pre-authentication code injection vulnerability in ChromaDB Python project version 1.0.0 or later that can allow unauthenticated remote arbitrary code execution on the server via a malicious model repository when trust_remote_code is set to true.
See the full picture, correlated to your attack surface.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules — auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.