CVE-2026-45829 exposes unauthenticated RCE in ChromaDB Python server

At a glance

What this is: This vulnerability shows that a ChromaDB Python server can be driven to remote code execution before authentication, turning a data service into an unauthenticated foothold.

Why it matters: It matters because platform teams, IAM leads, and AI security owners must treat unauthenticated service exposure as an identity failure mode, not just a software bug.

👉 Read Hadrian's vulnerability alert on CVE-2026-45829 in ChromaDB Python server

Context

Pre-authentication remote code execution is one of the clearest examples of why perimeter assumptions fail. When a service accepts attacker-controlled input before identity, policy, or session checks are applied, the control plane never gets a chance to help. In AI and data platforms, that becomes an access governance issue as much as a vulnerability issue, because exposed services often sit adjacent to secrets, models, and sensitive datasets.

For IAM, NHI, and platform security teams, the real concern is not only code execution but what follows next: token theft, workload impersonation, lateral movement, and abuse of trusted service identities. This kind of flaw is typical of internet-facing software that was deployed as if network location implied trust, which is exactly the assumption modern identity programmes are meant to remove.

Key questions

Q: What breaks when a public application server is hit by unauthenticated RCE?

A: The server stops being just an application tier and becomes a potential access bridge. Attackers can run commands, plant web shells, search for secrets, and reach adjacent services if account scope and network boundaries are too loose. The real failure is assuming an internet-facing server compromise stays contained to that one host.

Q: Why do AI data services create extra risk when they expose credentials or backend access?

A: AI data services often hold more trust than their user interface suggests. They may connect to model stores, retrieval indexes, object storage, and orchestration layers using service accounts and secrets. If an attacker can reach execution before authentication, that trust chain can be reused to steal credentials, move laterally, or access sensitive data that the front-end user was never meant to see.

Q: How do security teams know whether exposed services are being governed like privileged workloads?

A: Look for three signals: whether authentication sits before all state-changing paths, whether the service can reach secrets or internal dependencies by default, and whether its runtime identity has more privilege than the business function needs. If any of those are true, the service is being treated as trusted infrastructure rather than a constrained workload.

Q: What should teams do first when a pre-authentication RCE is disclosed?

A: Contain the exposed service before attackers can use it as an execution foothold. Isolate the host or container, revoke and rotate any reachable service credentials, review backend access paths, and confirm whether the process had access to secrets, internal APIs, or storage systems. The goal is to stop pivoting, not just patch the binary.

Technical breakdown

How pre-authentication RCE bypasses identity boundaries

Pre-authentication remote code execution means the server processes attacker input before it verifies who the caller is. In practice, that often happens in request handlers, deserialisation logic, or management endpoints that assume trusted deployment conditions. Once an attacker can influence code paths before authentication, ordinary IAM controls such as login, authorisation policy, or session expiry no longer protect the service. The issue is architectural, not cosmetic: identity checks must sit ahead of any unsafe execution path, especially in services that handle embeddings, documents, or orchestration functions.

Practical implication: move authentication and request validation in front of every externally reachable code path, including administrative and AI data APIs.

Why exposed AI data services become identity-adjacent risk surfaces

AI data platforms often sit close to the most valuable assets in an environment, including API keys, retrieval indexes, model configuration, and service credentials. If a server is exploitable before authentication, an attacker may use that foothold to harvest NHI secrets or impersonate workloads rather than simply crash the application. This is why AI infrastructure has to be governed like any other privileged production surface. The security question is not only whether the service is reachable, but whether it can be coerced into becoming a credential collection point.

Practical implication: inventory AI services as privileged assets and treat their credentials, tokens, and certificates as high-value NHI controls.

How zero trust changes the default for internet-facing services

Zero trust architecture rejects the idea that internal placement alone makes a service safe. For exposed AI and data components, the default must be deny, verify, and minimise trust even after initial contact. That means strong service-to-service authentication, narrow authorisation scopes, and explicit segmentation between front-door APIs and backend stores. When a vulnerability can hand out code execution before identity is established, the compensating controls need to limit what that process can reach, not merely what a user can log into.

Practical implication: apply zero trust segmentation so a compromised service cannot directly reach secrets stores, metadata services, or internal control planes.

Threat narrative

Attacker objective: The attacker aims to turn an exposed ChromaDB service into an unauthenticated execution foothold that can be leveraged for secret theft and broader internal compromise.

1. Entry occurs through an unauthenticated attack path in the ChromaDB Python server, allowing remote input to reach dangerous execution logic before identity checks are applied.
2. Escalation follows when the attacker uses code execution to operate inside the service context, which can expose local credentials, configuration, or backend connectivity.
3. Impact is achieved when the compromised service is used as a foothold for data access, secret theft, or broader internal movement within the environment.

Breaches seen in the wild

• Gladinet Hard-Coded Keys RCE Exploitation — Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Pre-authentication RCE is an identity failure mode, not only a vulnerability class. When a service can be driven into execution before authentication, the environment has already lost the boundary that IAM is supposed to enforce. This is especially consequential for AI and data platforms, where the compromised process often sits beside secrets, embeddings, and internal APIs. The practitioner takeaway is that identity governance must start at the service edge, not at the login screen.

AI data infrastructure creates a standing privilege problem the moment it is exposed. A ChromaDB-style service is rarely isolated in practice. It usually carries backend credentials, metadata access, and trust relationships into storage and orchestration layers. That makes the exposure window larger than the vulnerability itself, because one unauthenticated execution path can inherit a much broader set of permissions than the attacker should ever see. Practitioners should treat these services as privileged workloads and map their runtime trust chains explicitly.

Runtime trust chains need to be visible before attackers use them. The same control gap appears in many modern stacks: software is deployed with the assumption that deployment location equals trust, while actual access is governed by weak or implicit boundaries. In AI environments, that assumption breaks faster because the service often bridges user content, model data, and NHI secrets. The governance lesson is to model where execution can happen before asking who is allowed to act.

Named concept: pre-auth execution collapse. This is the failure mode where an attacker reaches code execution before the system has established identity, policy, or session context. It collapses the normal sequence of authenticate, authorise, then execute. The practical conclusion is clear: if execution can occur first, every downstream control becomes reactionary rather than preventative.

What this signals

A pre-authentication RCE in a data service reinforces a broader governance shift. Security teams can no longer assume that application-layer exposure is separate from identity risk, because the first successful request may already be enough to expose service credentials or internal trust paths. The practical programme response is to map AI and data services into the same control inventory used for privileged workloads and NHI governance.

Pre-auth execution collapse: this is the operational condition where a service allows code execution before the system establishes who the caller is. Once that happens, downstream controls such as least privilege and network segmentation become damage-limiting rather than preventative. Teams should use that lens when prioritising exposure review across internet-facing AI infrastructure.

For practitioner programmes, the signal is simple: any externally reachable service that can touch secrets, storage, or orchestration layers should be reviewed as part of identity governance, not only vulnerability management. Align that review with the OWASP NHI Top 10 and Zero Trust architecture principles so service identity, runtime privilege, and backend reach are assessed together.

For practitioners

• Harden every unauthenticated endpoint Review externally reachable AI and data services for request handlers, admin routes, and deserialisation paths that can execute before authentication. Remove or gate any code path that can alter state, access backend data, or invoke system functions without identity verification.
• Classify AI infrastructure as privileged Treat vector stores, retrieval services, and orchestration layers as privileged workloads because they frequently sit beside tokens, certificates, and backend secrets. Apply the same control discipline you would use for a management plane, including credential scoping and secret isolation.
• Enforce zero trust segmentation around backend dependencies Place strict network and identity boundaries between the exposed service and secrets stores, metadata services, and internal APIs. If a server is compromised, segmentation should prevent direct access to the systems that would turn code execution into broader compromise.
• Audit NHI exposure on service hosts Check what service accounts, API keys, and certificates are available to the ChromaDB process or its container at runtime. Rotate or remove anything that would let an attacker pivot from the application layer into adjacent systems after compromise.

Key takeaways

• This vulnerability shows how quickly a service can become an identity problem when code execution is reachable before authentication.
• The real risk is not just remote code execution, but the ability to inherit service credentials, backend access, and internal trust relationships.
• The strongest control is to remove implicit trust at the edge and constrain the service’s runtime identity before an attacker can use it.

Key terms

• Pre-authentication Code Execution: Code execution that occurs before a request is authenticated or rejected. In practice, it means the service can run attacker-controlled logic while still believing it is only processing input, which collapses the usual protection offered by login or authorization checks.
• Identity Trust Chain: The sequence of trust decisions that connects a message, user, application, model, tool, and credential into one working path. When any link is weak, an attacker can move from content manipulation to access abuse without needing a separate breach at each layer.
• Pre-auth execution collapse: A failure mode where the system allows execution before it establishes who the caller is. It collapses the normal sequence of identity verification, authorisation, and action, making downstream security controls reactive rather than preventative. This is a useful lens for exposed AI and data services that sit close to secrets or orchestration layers.

What's in the full article

Hadrian's full vulnerability alert covers the operational detail this post intentionally leaves for the source:

• Exploit conditions and request paths that enable unauthenticated execution in the ChromaDB Python server
• Version and deployment context details that help teams identify whether they are exposed
• Practical remediation notes for removing or constraining the vulnerable attack surface
• Validation guidance for confirming whether backend secrets or internal services were reachable after compromise

👉 Hadrian's full alert covers the exploit path, exposure conditions, and remediation context for CVE-2026-45829

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps security and identity practitioners align runtime privilege with programme-level controls.