Skip to content
OpenAdvisories

Package · PyPI

chromadb

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-45831

    ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

    The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing u…

    Chroma ChromaDB chromadb PyPI
  • High 8.8
    CVE-2026-45830

    ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

    A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

    Chroma ChromaDB chromadb PyPI