Notifications
Clear all
Topic starter
05/07/2026 6:43 pm
TL;DR: ChromaDB’s Python FastAPI server can execute attacker-controlled model code before authentication, turning a collection-creation request into pre-auth remote code execution and full process compromise, according to HiddenLayer research; the flaw affects version 1.0.0 through 1.5.8 and 73% of exposed instances were in that range. The deeper issue is not a single bug but a trust model that lets client-supplied model configuration run ahead of access control.
NHIMG editorial — based on content published by HiddenLayer: ChromaToast Served Pre-Auth
By the numbers:
- Of internet-exposed ChromaDB instances we discovered via Shodan, 73% are running version 1.0.0 or later, the version range in which the vulnerable feature exists.
- ChromaDB is one of the most widely adopted in the space, with 13 million monthly pip downloads and 27,500 GitHub stars.
Questions worth separating out
Q: What breaks when an AI service loads model code before authentication?
A: Authentication stops being the first security decision, so an unauthenticated request can still trigger code execution and create a full process compromise.
Q: Why do AI application servers need stricter trust controls than ordinary APIs?
A: Because they often fetch and execute external artefacts, not just process data.
Q: How can security teams reduce the blast radius of a compromised AI runtime?
A: Scope the service account, filesystem, and network so the process can only reach the data and secrets it genuinely needs.
Practitioner guidance
- Block remote-code model loading by default Disable trust_remote_code-style behaviour in production paths unless there is a separately reviewed allowlist for the exact model artefact and code path.
- Move authentication ahead of configuration loading Reorder request handling so identity checks and request rejection happen before any model fetch, deserialisation, or containerised code execution.
- Constrain the service process blast radius Run the service with the minimum possible filesystem, network, and secret access so a process compromise cannot expose broad environment variables, mounted credentials, or adjacent datasets.
What's in the full article
HiddenLayer's full research covers the operational detail this post intentionally leaves for the source:
- The exact request flow that lets an unauthenticated caller reach model loading before the auth check.
- The vulnerable endpoint pattern across the Python FastAPI server and the version range affected.
- The mitigation trade-offs between the Rust-based deployment path and the Python server.
- The disclosure timeline and code-level remediation guidance discussed by the researcher.
👉 Read HiddenLayer's analysis of ChromaDB pre-auth RCE and model-loading trust →
Pre-auth vector database RCE: what IAM and platform teams need to know?
Explore further
05/07/2026 6:58 pm
Pre-auth execution is a trust boundary failure, not just an auth bug. ChromaDB does not merely check identity too late. It executes attacker-influenced model code before identity can matter, which collapses the assumption that authentication is the first meaningful security gate. That is a broader platform design problem because any runtime that fetches and executes remote artefacts can turn input validation into a code path. Practitioners should treat this as a trust-boundary defect, not an isolated patch ticket.
A few things that frame the scale:
- Of internet-exposed ChromaDB instances we discovered via Shodan, 73% are running version 1.0.0 or later, the version range in which the vulnerable feature exists, according to The State of Secrets Sprawl 2025.
- 4.6% of all public GitHub repositories contain at least one hardcoded secret, according to The State of Secrets Sprawl 2025.
A question worth separating out:
Q: Who is accountable when an authenticated route still allows pre-auth compromise?
A: The accountable teams are the application owners, platform engineers, and security architects who define the request lifecycle and trust boundaries. A route label alone does not create protection if the implementation performs risky work before identity enforcement. Governance should review execution order, not just whether an endpoint is marked authenticated.
👉 Read our full editorial: ChromaDB pre-auth RCE exposes the trust gap in vector databases
