chroma vulnerabilities

2 known vulnerabilities in chroma from Chroma-core. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  chroma: Incorrect Authorization

  CVE-2026-92782Sep 16, 2026Chroma-core

  Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in fo

• 7.5 High severity

  chroma: Allocation of Resources Without Limits or Throttling

  CVE-2026-85664Sep 4, 2026Chroma-core

  Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denia