Loading vulnerability…
CVE-2026-45829 is a pre-authentication code injection / remote code execution vulnerability in the Python FastAPI implementation of ChromaDB. The flaw affects ChromaDB Python versions 1.0.0 through at least 1.5.8 according to the provided content. The vulnerable behavior occurs in collection creation API handling, including POST /api/v2/tenants/{tenant}/databases/{db}/collections, where attacker-controlled embedding/model configuration is processed before authentication is enforced. An unauthenticated attacker can supply a malicious Hugging Face or other model repository reference and set trust_remote_code=true, causing the underlying model-loading path used by sentence-transformers / HuggingFace integrations to fetch and execute remote Python code from the attacker-controlled repository. The root cause described in the content is that ChromaDB forwards client-supplied embedding function parameters into model loading logic and performs the authentication check only after the model has already been loaded and executed.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a functional Python proof-of-concept exploit for CVE-2026-45829 targeting ChromaDB Python deployments. The main script, cve_2026_45829_poc.py, checks the target version via /api/v2/version and then sends a POST request to /api/v2/tenants/{tenant}/databases/{database}/collections with crafted metadata that specifies a Hugging Face embedding model and sets trust_remote_code=true. The intended effect is to make the target fetch and execute attacker-controlled Python code from a remote model repository before authentication is enforced, yielding pre-auth RCE. The exploit treats HTTP 500 as a likely success condition because model loading may already have occurred even if auth later fails. The repository also includes a separate safe detection script that only checks the version endpoint, a simple Python reverse-shell listener binding to 0.0.0.0:4444 for post-exploitation interaction, and short text files for execution instructions, mitigation guidance, and references. Overall purpose: demonstrate and operationalize unauthenticated remote code execution against vulnerable ChromaDB versions 1.0.0 through 1.5.8 by abusing remote model loading from Hugging Face.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated remote code execution vulnerability in the Python FastAPI version of ChromaDB that allows attackers to trigger loading and execution of a malicious model before authentication is enforced.
An unauthenticated remote code execution vulnerability in the ChromaDB FastAPI server caused by processing user-controlled embedding function configuration before authentication, allowing attacker-controlled HuggingFace model loading with trust_remote_code enabled.
A maximum-severity unauthenticated remote code execution vulnerability in the Python FastAPI server component of ChromaDB, caused by model settings being processed before authentication checks, allowing attackers to load and execute a malicious Hugging Face model.
A pre-authentication code injection vulnerability in ChromaDB Python project version 1.0.0 or later that can allow unauthenticated remote arbitrary code execution on the server via a malicious model repository when trust_remote_code is set to true.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.