Saint ChromaToast, Who Toasted the Vector Database

Patron of vector databases, options that run remote code, and access checks placed last.

Life

On 18 May 2026 Esteban Tonglet of HiddenLayer described ChromaToast (CVE-2026-45829), a flaw in ChromaDB's Python server. Creating a collection, you could pass an embedding function with trust_remote_code turned on and a model of the attacker's choosing: the server loaded it and ran its code, and the authentication check only came afterward. An attacker with no credentials thus took control of the server.

Prayer

O Saint ChromaToast, who loads the code before asking who you are, let our servers check credentials first. Amen.

How to celebrate

Celebrated by using Chroma's Rust distribution or closing the Python server's port to anyone untrusted.

Open the model first and ask the name later: too late.