High severity · published Jun 12, 2026
CVE-2026-8828
A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any…
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
ChromaDB · Chroma
1.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8828
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8828
www.hiddenlayer.com
https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-2
More from ChromaDB
10.0
CVE-2026-45829
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server…
8.8
CVE-2026-45833
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a…
8.8
CVE-2026-45832
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization…
8.8
CVE-2026-45831
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never…
8.8
CVE-2026-45830
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in…