{
 "id": "AIR-2026-0730",
 "slug": "cve-2026-45830-chromadb-cross-tenant-access-vulnerability",
 "title": "CVE-2026-45830: ChromaDB cross-tenant access vulnerability",
 "summary": "A lack of proper authorization validation in ChromaDB enables any authenticated user to arbitrarily read, write, update, or delete data in collections across any tenant. The vulnerability compromises tenant isolation in shared vector database setups.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "ChromaDB"
 ],
 "incident_date": "2026-06-12",
 "incident_date_precision": "day",
 "first_reported": "2026-06-12",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-2wm9-hf6c-p5cr",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-45830: ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection",
   "published_at": "2026-06-12"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45830",
   "publisher": "NVD",
   "title": "CVE-2026-45830: A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to…",
   "published_at": "2026-06-12"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-45830",
  "authorization",
  "chromadb"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}