CVE-2026-45832: High severity pypi/chromadb vulnerability
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
chromadb/python V1 collection-level endpointsfrom your environment.Disable or remove the V1 collection-level endpoints until the authorization fix (ensuring tenant and database are forwarded) is implemented and deployed.
- Configuration
Modify the V1 collection-level endpoints so they pass the correct tenant and database values to the authorization layer instead of passing None.
ChromaDB Python V1 collection-level endpoints tenant/database passed to authorization layer = non-None (actual tenant and database identifiers) - Compensating control
Restrict access to the V1 collection-level endpoints at the network edge (firewall, WAF, API gateway, or ACLs) to trusted IPs or internal networks until the issue is remediated.
- Operational
Audit logs and access records for the V1 collection-level endpoints to detect possible unauthorized access; revoke or rotate any API keys, tokens, or sessions that may have been used to abuse the endpoints.
- Operational
Add automated tests (unit/integration) that verify tenant and database identifiers are forwarded to the authorization layer and that authorization is enforced for collection-level endpoints to prevent regressions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45832?
CVE-2026-45832 has a high severity rating of 8.8 according to the CVSS v4.0 scoring model.
What vulnerabilities does CVE-2026-45832 introduce?
CVE-2026-45832 allows attackers to bypass authorization controls through V1 endpoints in ChromaDB's Python project.
How can I mitigate the risks associated with CVE-2026-45832?
To mitigate CVE-2026-45832, ensure that authorization controls are properly re-implemented and validated for tenant and database parameters.
Is there an affected version for CVE-2026-45832?
CVE-2026-45832 affects all versions utilizing V1 collection-level endpoints in the ChromaDB Python project.
When was CVE-2026-45832 published?
CVE-2026-45832 was published on June 12, 2026.