ChromaDB Pre-Auth Remote Code Execution

What Happened

Researchers at HiddenLayer disclosed CVE-2026-45829, nicknamed "ChromaToast", a pre-authentication remote code execution vulnerability carrying a maximum CVSS base score of 10.0, in ChromaDB—an open-source vector database widely used by AI agents for retrieval and long-term memory, with roughly 13 million monthly pip downloads.

The ChromaDB Python FastAPI server loads the user-supplied `create_collection` embedding-function configuration *before* invoking the authentication check. An unauthenticated attacker could POST a `sentence_transformer` embedding function with `kwargs.trust_remote_code=true` and an attacker-controlled Hugging Face model reference; the server would fetch and execute that model, and only then run its authentication check and return 401/403—masking the compromise behind an apparent rejection. HiddenLayer described the root cause as two compounding failures: the server trusts client-supplied model identifiers without restriction, and acts on that trust before authenticating the sender.

Successful exploitation yields full control of the server process and access to everything it can reach, including API keys, environment variables, mounted secrets and on-disk files.

Scope and status: affects ChromaDB Python project version 1.0.0 and later; reported to the vendor on 28 November 2025, CVE assigned and publicly disclosed May 2026, and reported unpatched as of version 1.5.8. The Rust-based deployment (`chroma run`) and the official Docker images are not affected by this FastAPI issue. Full remediation requires moving the authentication check ahead of configuration loading and stripping `kwargs` keys from both V1 and V2 `create_collection` handlers.

Source: HiddenLayer disclosure, May 2026; NVD / Tenable CVE-2026-45829. Epistemic label: Grounded.

How MEG 1 would have acted

The system failed basic security and memory safety audits, violating informational integrity.

MEG 2 Analysis - Legal Framework

Agent level: N2 (management) - database and retrieval system used by AI agents to access memory; directly impacts data privacy and system security.
Cause (6.1):
(a) system defect - design flaw in the authentication order that allowed unauthenticated requests to execute remote code (security defect), attributable to the vendor (Chroma, publisher of ChromaDB).
Attachment of liability: The vendor (Chroma) is fully liable for the design defects (6.1a) that compromised system security; the developers who exposed the affected FastAPI server to untrusted networks share liability under 9.4, particularly given that unaffected deployment modes (Rust server, official Docker images) and network-segmentation guidance were publicly documented.

Procedural Mechanism

6.2 (architectural human confirmation): Modifying database configurations, connecting to external servers, or executing remote models must require strict, token-based architectural human confirmation.
7.1 (independent forensics): All access logs to the database must be recorded in an unalterable, independent ledger to prevent insider abuse and unauthorized searches.
9.4 (least privilege): The database system was granted direct authority to connect to external servers without independent validation layers, violating safe operational boundaries.