Chroma-core vulnerabilities
We track 2 vulnerabilities in Chroma-core products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score
Latest Chroma-core vulnerabilities
- 8.1 High severity
chroma: Incorrect Authorization
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in fo
- 7.5 High severity
chroma: Allocation of Resources Without Limits or Throttling
Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denia