ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-45830US | high8.8 | — | ||
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in an… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/CVE-2026-45830WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2488408WEB
- https://github.com/advisories/GHSA-2wm9-hf6c-p5crADVISORY
- https://github.com/chroma-core/chromaPACKAGE
- https://github.com/chroma-core/chroma/issues/7588WEB
- https://github.com/chroma-core/chroma/pull/7602WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-45830ADVISORY
- https://pypi.org/project/chromadbPACKAGE
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan