CVE-2026-45831: High severity pypi/chromadb vulnerability
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
chromadb/SimpleRBACAuthorizationProviderfrom your environment.Uninstall or stop using the SimpleRBACAuthorizationProvider from your ChromaDB deployment if tenant-scoped authorization is required and no vendor fix is available.
- Configuration
Disable the SimpleRBACAuthorizationProvider (set SimpleRBACAuthorizationProvider.enabled = false) until a proper fix is available, or ensure the provider enforces tenant, database, and collection scoping for permission checks.
ChromaDB SimpleRBACAuthorizationProvider SimpleRBACAuthorizationProvider.enabled = false - Compensating control
Apply compensating controls to prevent cross-tenant actions: enforce strict tenant isolation (network segmentation, per-tenant ACLs), restrict user privileges to the minimum necessary, and limit access to management/administrative endpoints to trusted IPs and accounts.
- Operational
Audit logs for any cross-tenant operations, investigate potential unauthorized access, and rotate credentials/keys for affected accounts or services as necessary.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45831?
The severity of CVE-2026-45831 is high, with a CVSS score of 8.8.
How do I fix CVE-2026-45831?
To fix CVE-2026-45831, update to the latest version of the ChromaDB Python project that addresses this vulnerability.
What impact does CVE-2026-45831 have on users?
CVE-2026-45831 allows users to perform cross tenant actions due to insufficient permission checks across tenants, databases, or collections.
What versions are affected by CVE-2026-45831?
CVE-2026-45831 affects all versions of the ChromaDB Python project from 0.5.0 onwards.
Is there a workaround for CVE-2026-45831 until it is patched?
No specific workaround for CVE-2026-45831 is recommended; it is advised to upgrade to a fixed version as soon as possible.