Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

ChromaDB Python API exposure mitigation (CVE-2026-45829)

Advisory/Mitigation
First reported
Last updated
Happening score
H score 25
1 unique sources, 1 articles

Summary

Hide ▲

HiddenLayer urged ChromaDB users to harden exposed deployments because CVE-2026-45829 can still enable code execution on the Python FastAPI server. Until patch status is confirmed, the guidance is to use the Rust frontend, avoid publicly exposing the Python server, and restrict network access to the ChromaDB API port. The advice is aimed at reducing risk for internet-reachable systems that could be hijacked by crafted requests.

Related Happenings

ChromaDB Python FastAPI unauthenticated RCE (CVE-2026-45829)

Vulnerability
First: 20.05.2026 01:25 Last: 20.05.2026 01:25 Sources 1

How related: A max-severity vulnerability in the latest Python FastAPI version of the ChromaDB project allows unauthenticated attackers to run arbitrary code on exposed servers.

About this happening: A **max-severity** flaw in **ChromaDB's Python FastAPI server** lets **unauthenticated attackers** run **arbitrary code** on **exposed servers**, making internet-facing deployment...

Open Happening

Windows ikeext.dll double-free RCE (CVE-2026-33824)

Vulnerability
First: 13.05.2026 16:46 Last: 13.05.2026 16:46 Sources 1

About this happening: **CVE-2026-33824** is a **double-free flaw** in **Windows ikeext.dll** that can let an **unauthenticated attacker** trigger **remote code execution** on systems with **IKEv2** ena...

Open Happening

Ollama GGUF model loader heap out-of-bounds read security flaw (CVE-2026-7482)

Vulnerability
First: 10.05.2026 15:41 Last: 10.05.2026 15:41 Sources 1

About this happening: **CVE-2026-7482** in **Ollama** is a critical **GGUF model loader** out-of-bounds read that can let a **remote, unauthenticated attacker** leak **entire process memory** from expo...

Open Happening

Terrarium sandbox escape RCE (CVE-2026-5752)

Vulnerability
First: 22.04.2026 10:16 Last: 22.04.2026 10:16 Sources 1

About this happening: A critical **Terrarium** sandbox-escape flaw, **CVE-2026-5752**, can let local attackers execute code as **root** and break out of the container. The weakness is tied to **JavaScr...

Open Happening

Cisco security patch release for CVE-2026-20184

Security Patch Release
First: 16.04.2026 14:27 Last: 16.04.2026 14:27 Sources 1

About this happening: **Cisco** released patches for **four critical flaws** affecting **Identity Services Engine (ISE)**, **ISE-PIC**, and **Webex Services**, closing paths to **arbitrary code executi...

Open Happening

Timeline

  1. 20.05.2026 01:25 1 articles · 8d ago

    HiddenLayer reports CVE-2026-45829 to ChromaDB

    Initial Disclosure

    HiddenLayer reported CVE-2026-45829 to ChromaDB on February 17 after finding that ChromaDB's Python FastAPI server could let unauthenticated attackers run arbitrary code on exposed systems by reaching an authenticated endpoint before the authentication check runs.

    Show sources
    Open in new tab
  2. 20.05.2026 01:25 2 articles · 8d ago

    HiddenLayer recommends exposure reduction and Rust frontend use

    Mitigation Patch Update

    HiddenLayer recommends that impacted ChromaDB deployments use the Rust frontend, avoid exposing the Python server publicly, and restrict network access to the ChromaDB API port until CVE-2026-45829 is confirmed patched; the researchers also advise scanning ML model artifacts before runtime because loading public models with 'trust_remote_code' can execute untrusted code.

    Show sources
    Open in new tab