chroma-core/chroma Security Advisories | GitStock

high2026-06-12

ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

GHSA-xph7-9rjv-w5fr · CVE-2026-45831

critical2026-06-12

ChromaDB has a code injection vulnerability

GHSA-36p7-vc44-83pf · CVE-2026-45833

high2026-06-12

ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

GHSA-2wm9-hf6c-p5cr · CVE-2026-45830

critical2026-05-18

ChromaDB Python project has a pre-authentication code injection vulnerability

GHSA-f4j7-r4q5-qw2c · CVE-2026-45829