CVE-2026-45829
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
वीकनेस
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
संदर्भ
- https://github.com/chroma-core/chroma/issues/6717
- https://www.hiddenlayer.com/research/chromatoast-served-pre-auth
- https://access.redhat.com/security/cve/CVE-2026-45829
- https://bugzilla.redhat.com/show_bug.cgi?id=2479623
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45829.json
- https://www.hiddenlayer.com/research/chromatoast-served-pre-auth
हमलावर से पहले बग आप ढूँढें।
GitHub से साइन इन करें और एक मिनट से भी कम में अपना पहला ऑडिट चलाएँ। फ़्री प्लान के लिए क्रेडिट कार्ड की ज़रूरत नहीं।