FlagThis

Abstract

CVE-2026-45829 ("ChromaToast") is a CVSS 10.0 pre-authentication remote code execution vulnerability in ChromaDB's Python FastAPI server, affecting versions 1.0.0 through 1.5.8. An unauthenticated attacker with HTTP access to the API port can achieve full server compromise by supplying a malicious HuggingFace model reference in a collection creation request, gaining a shell with the privileges of the database process.