PatchTheCVEchromadb vulnerabilities and fixes
Recent CVEs affecting chromadb, with upgrade or downgrade steps. 4 tracked.
chromadb has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-06-12. Highest priority: CVE-2026-45830 (score 38/100).
- CVE-2026-45830 HIGH 8.8 UPGRADE A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authen
- CVE-2026-45833 HIGH 8.8 UPGRADE A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticat
- CVE-2026-45832 HIGH 8.8 UPGRADE All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the au
- CVE-2026-45831 HIGH 8.8 UPGRADE The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python p
FAQ
How do I fix chromadb vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is chromadb being exploited right now?
None of the tracked chromadb CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which chromadb CVE should I patch first?
CVE-2026-45830 currently ranks highest (38/100): A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authen.