CVE-2026-45830: ChromaDB cross-tenant access vulnerability

# CVE-2026-45830: ChromaDB cross-tenant access vulnerability

https://gcdradar.vercel.app/incidents/cve-2026-45830-chromadb-cross-tenant-access-vulnerability · AIR-2026-0730 · closed 2026-06-12

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-06-12
- AI role: Attack on AI
- Products: ChromaDB
- CVE ids: CVE-2026-45830
- CVSS: 8.8

## Summary

A lack of proper authorization validation in ChromaDB enables any authenticated user to arbitrarily read, write, update, or delete data in collections across any tenant. The vulnerability compromises tenant isolation in shared vector database setups.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-06-12: CVE-2026-45830: A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to… (https://nvd.nist.gov/vuln/detail/CVE-2026-45830)
- 2026-06-12: CVE-2026-45830: ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection (https://github.com/advisories/GHSA-2wm9-hf6c-p5cr)

## Sources

- 2026-06-12 GitHub Advisory Database: CVE-2026-45830: ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection https://github.com/advisories/GHSA-2wm9-hf6c-p5cr
- 2026-06-12 NVD: CVE-2026-45830: A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to… https://nvd.nist.gov/vuln/detail/CVE-2026-45830

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.