Unpatched ChromaDB Vulnerability Can Lead to Server Takeover
Unpatched ChromaDB RCE vulnerability allows unauthenticated remote code execution and server takeover.
CVE-2026-45829, dubbed ChromaToast, is a pre-authentication remote code execution vulnerability in ChromaDB affecting all versions since 1.0.0. The flaw stems from the server trusting client-supplied model identifiers and executing them before authentication checks, allowing attackers to download and run arbitrary code via crafted HuggingFace models. With 13M monthly downloads and 73% of internet-accessible deployments vulnerable, the issue remains unpatched despite disclosure attempts to Chroma starting in November 2025.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Chroma?
Get an email when a new story names Chroma, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-45829