The ChromaDB vulnerability is a serious warning for organizations building AI applications: AI infrastructure is now part of the attack surface, not just an innovation layer. The reported flaw, CVE-2026-45829, affects the Python FastAPI version of ChromaDB and can allow unauthenticated attackers to execute arbitrary code on exposed servers. ChromaDB is widely used as a vector database and retrieval backend for AI and agentic applications, with the PyPI package seeing nearly 14 million monthly downloads, so this is not a niche concern hiding in some forgotten corner of the internet.

The vulnerability is especially concerning because the authentication check happens too late. According to the report, an attacker can send a crafted request that forces ChromaDB to load a malicious model from Hugging Face before authentication is enforced, meaning the server may reject the request only after the attacker’s payload has already executed. That is not “missing authentication”; it is authentication standing politely at the exit door while the burglar is already inside making tea. 

Organizations using ChromaDB should immediately review whether they are running the vulnerable Python API server, especially if it is exposed over HTTP or reachable from untrusted networks. The article notes that users running ChromaDB locally without exposing the API server, or using the Rust front-end, are not affected in the same way. Until the patch status is fully clear, the safer approach is to avoid public exposure of the Python server, restrict access to the ChromaDB API port, move to the Rust frontend where applicable, and scan ML model artifacts before runtime. 

The bigger lesson is that AI security is not only about prompt injection or data leakage. Vector databases, model-loading workflows, APIs, plugins, and ML dependencies must be treated like production-grade infrastructure. Any system that can fetch models, execute code, or access business data must be governed with authentication, network isolation, least privilege, monitoring, and secure deployment practices. AI stacks are becoming business-critical systems, and pretending they are just experimental developer tools is exactly how experiments turn into incidents.

A max-severity vulnerability in the latest Python FastAPI version of the ChromaDB project allows unauthenticated attackers to run arbitrary code on exposed servers. [...]

Source: Max-severity flaw in ChromaDB for AI apps allows server hijacking via Bleeping Computer — published 19 May 2026.