CVE-2026-45830
HighAdvisory
Published 12 Jun 2026In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.8
- base score, highest
- EPSS
- 0.003
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 10
- of 17,781 indexed, latest versions
- Container images
- 8
- deployed by those charts
- Fix available
- None
- affected package
ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection
Carried by container images the latest versions of 10 of 17,781 indexed charts deploy, on 8 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| chromadbpypi | 0.5.0, 0.5.7, 0.5.20, 0.5.23+2 more | no fix listed | 8 |
- OSV records
- GHSA-2wm9-hf6c-p5cr
- Also known as
- PYSEC-2026-3813
Charts affected
10 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| difydify-helmVerified publisher | 0.38.0 | 1 of 11See more | 22,002 |
| difykubeblocksVerified publisher | 0.5.1 | 1 of 5See more | 20,403 |
| langflow-idelangflow | 0.1.2 | 1 of 2See more | 3,980 |
| langflow-runtimelangflow | 0.1.1 | 1 of 1See more | 144 |
| csghubcsghubVerified publisher | 2.4.3 | 1 of 34See more | 58,897 |
| difydify | 1.0.0 | 1 of 4See more | 19,224 |
| langflowhelmforgeVerified publisher | 2.0.0 | 1 of 1See more | 144 |
| osdfir-infrastructureosdfir-infrastructureVerified publisher | 2.15.0 | 1 of 40See more | 71,208 |
| yetiosdfir-infrastructureVerified publisher | 1.0.5 | 1 of 4See more | 6,583 |
| web-retrievertest-opea | 1.0.0 | 1 of 1See more | 5,350 |
Container images carrying it
8 by charts deploying them
A fixed version is listed for 0 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| langflowai/ | 65796601f3fc | chromadb | no fix listed | 3 |
| langgenius/ | 066035f93856 | chromadb | no fix listed | 1 |
| langgenius/ | dcefa5f7c47c | chromadb | no fix listed | 1 |
| langgenius/ | fca918260dd6 | chromadb | no fix listed | 1 |
| opea/ | fe08165d7770 | chromadb | no fix listed | 1 |
| opencsghq/ | 2f03fead54db | chromadb | no fix listed | 1 |
| yetiplatform/ | 9bcbe2650a14 | chromadb | no fix listed | 1 |
| yetiplatform/ | 9c3006cedcca | chromadb | no fix listed | 1 |