Max-severity flaw in ChromaDB for AI apps allows server hijacking
2026-05-20T01:23:30Z•7ecb7e56bb4160d9894fb27a543139b62c16d1fa2c09ad1f70334a2bbbec3a81
ai-applicationschromadbcritical-vulnerabilityfastapipythonrceremote-code-executionsecurity-advisoryserver-hijackingunauthenticatedvector-db
What happened
A max-severity (critical) vulnerability in ChromaDB's Python FastAPI implementation allows unauthenticated attackers to execute arbitrary code on publicly exposed servers, enabling server hijacking, data and model theft, and full system compromise. Operators should immediately isolate exposed instances, apply vendor-provided fixes or mitigations, and restrict network access to affected services until patched.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 7ecb7e56bb4160d9894fb27a543139b62c16d1fa2c09ad1f70334a2bbbec3a81
- Enrichment time
- 2026-05-20T01:23:30Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.