This vulnerability (CVE-2026-45829) affects ChromaDB version 1.0.0 and later, enabling unauthenticated remote code execution through the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint when trust_remote_code is enabled. The issue arises from improper control of code generation (CWE-94), allowing attackers to inject and execute arbitrary code by submitting a crafted model repository. The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory from Red Hat is available but does not specify a patch or remediation status.

Successful exploitation results in unauthenticated remote code execution on the server hosting ChromaDB, compromising confidentiality, integrity, and availability of the system. This can lead to full system compromise without any required authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-45829 for current remediation guidance. Until an official fix is available, avoid enabling the trust_remote_code parameter or restrict access to the vulnerable API endpoint to trusted users only.