NIXPKGS-2026-1919

Permalink CVE-2026-45831

8.8 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

Created suggestion 13 hours ago
@LeSuisse accepted 8 hours ago
@LeSuisse published on GitHub 7 hours ago

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of …

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.

References

https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-3

Affected products

chromadb

=<*

Matching in nixpkgs

pkgs.python313Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

pkgs.python314Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

pkgs.pkgsRocm.python3Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

Package maintainers

@sarahec Sarah Clark <seclark@nextquestion.net>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>

Permalink CVE-2026-45830

8.8 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

Created suggestion 13 hours ago
@LeSuisse accepted 8 hours ago
@LeSuisse published on GitHub 7 hours ago

A lack of authorization validation in version 0.4.17 or later …

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

References

https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb

Affected products

chromadb

=<*

Matching in nixpkgs

pkgs.python313Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

pkgs.python314Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

pkgs.pkgsRocm.python3Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

Package maintainers

@sarahec Sarah Clark <seclark@nextquestion.net>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>

Permalink CVE-2026-45833

9.4 CRITICAL

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): High (H)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): High (H)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): High (H)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

Created suggestion 13 hours ago
@LeSuisse accepted 8 hours ago
@LeSuisse published on GitHub 7 hours ago

A code injection vulnerability in version 0.4.17 or later of …

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.

References

https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-5 exploit

Affected products

chromadb

=<*

Matching in nixpkgs

pkgs.python313Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

pkgs.python314Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

pkgs.pkgsRocm.python3Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

Package maintainers

@sarahec Sarah Clark <seclark@nextquestion.net>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>

Permalink CVE-2026-45832

8.8 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

Created suggestion 13 hours ago
@LeSuisse accepted 8 hours ago
@LeSuisse published on GitHub 7 hours ago

All V1 collection-level endpoints in ChromaDB's Python project pass None …

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

References

https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-4

Affected products

chromadb

=<*

Matching in nixpkgs

pkgs.python313Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

pkgs.python314Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

pkgs.pkgsRocm.python3Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

Package maintainers

@sarahec Sarah Clark <seclark@nextquestion.net>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>

Permalink CVE-2026-8828

8.8 HIGH

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): High (H)
Subsequent System Impact Integrity (SI): High (H)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): High (H)
Modified Subsequent System Impact Integrity (MSI): High (H)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 7 hours ago by @LeSuisse Activity log

Created suggestion 13 hours ago
@LeSuisse accepted 8 hours ago
@LeSuisse published on GitHub 7 hours ago

A lack of authorization validation in version 1.0.0 or later …

A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

References

https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-2

Affected products

chromadb

=<*

Matching in nixpkgs

pkgs.python313Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

pkgs.python314Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

pkgs.pkgsRocm.python3Packages.chromadb

AI-native open-source embedding database

nixos-unstable 1.5.8
- nixpkgs-unstable 1.5.8
- nixos-unstable-small 1.5.8
nixos-26.05 1.5.8
- nixos-26.05-small 1.5.8
- nixpkgs-26.05-darwin 1.5.8

Package maintainers

@sarahec Sarah Clark <seclark@nextquestion.net>
@fabaff Fabian Affolter <mail@fabian-affolter.ch>

Nixpkgs security tracker

Details of issue NIXPKGS-2026-1919

References

Affected products

Matching in nixpkgs

pkgs.python313Packages.chromadb

pkgs.python314Packages.chromadb

pkgs.pkgsRocm.python3Packages.chromadb

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.python313Packages.chromadb

pkgs.python314Packages.chromadb

pkgs.pkgsRocm.python3Packages.chromadb

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.python313Packages.chromadb

pkgs.python314Packages.chromadb

pkgs.pkgsRocm.python3Packages.chromadb

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.python313Packages.chromadb

pkgs.python314Packages.chromadb

pkgs.pkgsRocm.python3Packages.chromadb

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.python313Packages.chromadb

pkgs.python314Packages.chromadb

pkgs.pkgsRocm.python3Packages.chromadb

Package maintainers