ChromaDB Flaw Exposes Servers to Remote Attacks

It was a quiet Thursday afternoon when Chris Wong, a security analyst at HiddenLayer, realized something wasn't right. He was deep into a routine check of AI application logs when a peculiar API call caught his attention. It was an anomaly, something that seemed benign at first but carried a hidden sting.

In the world of ChromaDB, a popular vector database used for AI applications, a vulnerability known as CVE-2026-45829 had slipped past unnoticed. This flaw, HiddenLayer researchers found, allows unauthenticated attackers to execute arbitrary code and access sensitive data on vulnerable servers. ChromaDB, spanning versions from 1.0.0 to 1.5.8, has an API server at its core where the issue resides. And the developers, it seems, have been elusive, with multiple report attempts since February unanswered.

The vulnerability arises from a race condition in ChromaDB’s code. As Wong discovered, the problem lies in the timing. The server first fetches and executes a model before checking authentication. Thus, attackers can exploit this by sending requests that load malicious configurations from sites like Hugging Face.

“The authentication is not missing, it’s just in the wrong place,” said HiddenLayer in their report. By the time the server responds with an error, the damage is done — the attacker's payload has already been executed.

With over 73% of publicly accessible ChromaDB instances running a vulnerable version, the risk is substantial. For now, HiddenLayer advises using the Rust implementation instead of the Python FastAPI server and restricting ChromaDB port access to trusted IPs.

Vector databases like ChromaDB are integral to retrieval-augmented generation workflows, storing unstructured data as vector embeddings. However, this flexibility also opens doors to exploitation. By configuring a new collection with a custom embeddings function pointing to a malicious model, attackers can effectively run their code on the server.

“From the outside, it appears to be a failed API call,” the researchers noted. Yet, to the attacker, it's a successful breach, granting access to environment variables, API keys, and more.

And so, as Wong sat back in his chair, he pondered the eerie silence from ChromaDB's developers. A patch might come someday, but for now, the gap remains — a waiting invitation to those with less noble intentions.