- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,641
What a hacker can do after the attack on Chromab.
Chromabs found a vulnerability that allows you to execute the code on the server without logging in. The problem was received by the CVE-2026-45829 (assessment on CVSS: 10) and has not yet been corrected in version 1.5.8.
Chromab is an open vector database used in artificial intelligence applications to find similar data. The project is popular among the developers: the package is downloaded about 13 million times a month, and the repository on GitHub scored 27 500 stars. Among ChromabD users are Capital One and UnitedHealthcare.
The problem affects the ChromaDB-based ChromaDB based on FastAPI. The server can download and run the user-defined embedded function before checking the access rights. It is enough for the attacker to access the ChromabD program interface over HTTP and send a specially prepared request for the creation of the collection.
The vulnerability is related to how ChromabD works with embinity models. Such models turn the text into numerical representations so that the base can find documents close in meaning, even without a coincidence of words. When creating a collection, the client indicates which model to use and with what parameters to load it. The server accepts the model name and additional settings from the query, after which it turns to Hugging Face and downloads the model.
A dangerous parameter was trust_remone_code. In Hugging Face, such a flag allows you to download and execute Python code from the model repository. Such a mechanism is needed for some non-standard models, but when working with someone else's repository turns the load of the model into the launch of someone else's code. Chromab passes the parameter because it checks only the types of values, and the logical value of the true is considered permissible.
The second part of the error is related to the order of action. The end point of the collection is marked as requiring logging in, but the server first analyzes the configuration, downloads and loads the model, and only then checks the access rights. As a result, the request without credentials at the end is rejected, but the malicious code is already being executed at this point. Outside the attack looks like an unsuccessful call to the software interface, and the attacker gets access to the server process.
After a successful attack, an attacker can reach anything available to the ChromaDB process: environment variables, software interface keys, connected secrets, and disk data.
According to Hidden Layer, the vulnerability appeared in ChromaDB 1.0.0 and persists at 1.5.8. Among the images found through Shodan, ChromABD 73% operated on version 1.0.0 or newer, that is, they were in the range with a vulnerable function.
There is no complete correction yet. The authors of the report believe that Chromabs should check access rights before booting the configuration and block the transmission of dangerous parameters when creating collections. Before the release of the corrected version, the owners of the installations are advised to use the launch path on the basis of Rust, including chroma run and images of Docker Hub starting at 1.0.0, since this option is not affected. If you use a FastAPI Python server, access to ChromabDB only by trusted customers should be restricted.
The report reported a report reported a problem on February 17, 2026, then several times tried to contact the team through other channels, including IT-ISAC and social networks. The last attempt to contact the developers is dated April 16, 2026.
Chromabs found a vulnerability that allows you to execute the code on the server without logging in. The problem was received by the CVE-2026-45829 (assessment on CVSS: 10) and has not yet been corrected in version 1.5.8.
Chromab is an open vector database used in artificial intelligence applications to find similar data. The project is popular among the developers: the package is downloaded about 13 million times a month, and the repository on GitHub scored 27 500 stars. Among ChromabD users are Capital One and UnitedHealthcare.
The problem affects the ChromaDB-based ChromaDB based on FastAPI. The server can download and run the user-defined embedded function before checking the access rights. It is enough for the attacker to access the ChromabD program interface over HTTP and send a specially prepared request for the creation of the collection.
The vulnerability is related to how ChromabD works with embinity models. Such models turn the text into numerical representations so that the base can find documents close in meaning, even without a coincidence of words. When creating a collection, the client indicates which model to use and with what parameters to load it. The server accepts the model name and additional settings from the query, after which it turns to Hugging Face and downloads the model.
A dangerous parameter was trust_remone_code. In Hugging Face, such a flag allows you to download and execute Python code from the model repository. Such a mechanism is needed for some non-standard models, but when working with someone else's repository turns the load of the model into the launch of someone else's code. Chromab passes the parameter because it checks only the types of values, and the logical value of the true is considered permissible.
The second part of the error is related to the order of action. The end point of the collection is marked as requiring logging in, but the server first analyzes the configuration, downloads and loads the model, and only then checks the access rights. As a result, the request without credentials at the end is rejected, but the malicious code is already being executed at this point. Outside the attack looks like an unsuccessful call to the software interface, and the attacker gets access to the server process.
After a successful attack, an attacker can reach anything available to the ChromaDB process: environment variables, software interface keys, connected secrets, and disk data.
According to Hidden Layer, the vulnerability appeared in ChromaDB 1.0.0 and persists at 1.5.8. Among the images found through Shodan, ChromABD 73% operated on version 1.0.0 or newer, that is, they were in the range with a vulnerable function.
There is no complete correction yet. The authors of the report believe that Chromabs should check access rights before booting the configuration and block the transmission of dangerous parameters when creating collections. Before the release of the corrected version, the owners of the installations are advised to use the launch path on the basis of Rust, including chroma run and images of Docker Hub starting at 1.0.0, since this option is not affected. If you use a FastAPI Python server, access to ChromabDB only by trusted customers should be restricted.
The report reported a report reported a problem on February 17, 2026, then several times tried to contact the team through other channels, including IT-ISAC and social networks. The last attempt to contact the developers is dated April 16, 2026.
