CVE-2026-45832

No fix known EPSS <1%CVSS 8.8

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

Published 2026-06-12 · CVE record · OSV

Products: ChromaDB, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI)