ChromaDB FastAPI RCE allows unauthenticated arbitrary code execution

Affected Systems

ChromaDB latest Python FastAPI version. Affects exposed ChromaDB servers accessible over the network. No CVE assigned yet.

Exploitation Status

Vulnerability disclosed with max severity rating. Exploitation status unknown - no information provided on active exploitation or public PoC availability.

Business Impact

Unauthenticated remote code execution enables full server compromise. Attackers can execute arbitrary commands, exfiltrate vector databases and embeddings, pivot to internal networks, or deploy ransomware. Particularly critical for organizations using ChromaDB for AI/ML workloads with sensitive data. No CVE tracking complicates vulnerability management workflows.

Urgency

🔴 Immediate

Recommended Actions

• Immediately inventory all ChromaDB FastAPI deployments and verify network exposure
• Block external access to ChromaDB servers at firewall/network level - restrict to trusted internal IPs only
• Monitor ChromaDB GitHub repository and security advisories for patches and apply immediately when available
• Review authentication controls - ensure ChromaDB is not running in default unauthenticated mode
• Audit logs for suspicious API calls or unexpected code execution on ChromaDB servers since initial deployment