CVE-2026-8828: A lack of authorization validation in version 1

Synopsis

An authorization bypass in ChromaDB (Rust implementation, version 1.0.0 and later) allows any authenticated user to read, write, update, or delete data across all tenant collections, regardless of which tenant they belong to. The flaw is reachable over the network and requires only a low-privilege account, meaning no special credentials are needed beyond a basic login. Successful exploitation gives an attacker full cross-tenant data access and the ability to modify or destroy any collection. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ChromaDB service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationRequired

  A low-privilege account is sufficient; the CVSS vector specifies PR:L, so any valid authenticated user can trigger the vulnerability without needing admin rights.

• Victim interactionNot required

  No victim action is needed; the CVSS vector specifies UI:N, so the attacker can exploit the flaw entirely on their own.

• Attack complexityDetail

  The CVSS vector specifies AC:L with AT:P (attack requirements: present), meaning the exploit itself is straightforward but depends on the presence of multi-tenant data in the instance; no race condition or special memory layout is needed.

Blast Radius

• Reads stored records, embeddings, and metadata from any tenant's collection, regardless of tenant ownership.
• Writes or overwrites data into any tenant's collection, injecting arbitrary records or embeddings.
• Updates existing documents or metadata across all tenants, corrupting application state silently.
• Deletes collections or individual records belonging to any tenant, causing irreversible data loss.