Exploit for CVE-2026-45829

githubexploit · 2026-05-20

Description

General exploit analysis for CVE-2026-45829 affecting ChromaDB.

Parameterembedding_function · request body

Path/api/v2/tenants/{tenant}/databases/{db}/collections

Pre-auth RCE via crafted embedding_function configuration in collection creation endpoint when trust_remote_code is true.

10.0

HIGH SEVERITY

Version 4.0

VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H

Attack Vector:NETWORK

Attack Complexity:LOW

Attack Requirements:NONE

Privileges Required:NONE

User Interaction:NONE

100%confidence this exploit runs

Based on 2 file(s) in the source

12.4%higher than 95.7% of all CVEs

Updated 2026-07-17

Modified:2026-05-20 15:39

Last Seen:2026-05-20 15:46

Reporter:fevar54

Written in:Python

Last commit:2026-05-20

README2 lines

## https://sploitus.com/exploit?id=B2ADC265-C481-5CB4-8010-5B4B1140D35D
# FULL-ANALYSIS---CVE-2026-45829-ChromaDB-