REDHAT-BUG-2488408: High severity pypi/chromadb vulnerability

Published Jun 12, 2026

Updated

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

Affected Software

1 affected component

pypi/chromadb>=0.4.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ChromaDB Python project to a version that resolves this vulnerability.
Fixed in 0.4.17

Event History

Jun 12, 2026

Data Sourced

via Red Hat·04:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2488408?

The severity of REDHAT-BUG-2488408 is high, rated at 7.

What vulnerabilities does REDHAT-BUG-2488408 introduce?

REDHAT-BUG-2488408 allows authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection.

How do I fix REDHAT-BUG-2488408?

To fix REDHAT-BUG-2488408, ensure to upgrade to a version of ChromaDB that includes authorization validation.

Which version of ChromaDB is affected by REDHAT-BUG-2488408?

Versions 0.4.17 and later of the ChromaDB Python project are affected by REDHAT-BUG-2488408.

What impact does REDHAT-BUG-2488408 have on data security?

REDHAT-BUG-2488408 poses a significant risk to data security by allowing unauthorized access to any tenant's data.