{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45833.json" } ], "title": "chromadb: ChromaDB: Arbitrary Code Execution via Code Injection", "tracking": { "current_release_date": "2026-07-31T09:54:16+00:00", "generator": { "date": "2026-07-31T09:54:16+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.8" } }, "id": "CVE-2026-45833", "initial_release_date": "2026-06-12T15:16:33.238000+00:00", "revision_history": [ { "date": "2026-06-12T15:16:33.238000+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-06-16T15:10:09+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-07-31T09:54:16+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AI (RHEL AI) 3", "product": { "name": "Red Hat Enterprise Linux AI (RHEL AI) 3", "product_id": "red_hat_enterprise_linux_ai_(rhel_ai)_3", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux_ai:3" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux AI (RHEL AI) 3" }, { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift AI (RHOAI)", "product": { "name": "Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai)", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_ai" } } } ], "category": "product_family", "name": "Red Hat OpenShift AI (RHOAI)" }, { "category": "product_version", "name": "rhelai3/bootc-cuda-rhel9", "product": { "name": "rhelai3/bootc-cuda-rhel9", "product_id": "rhelai3/bootc-cuda-rhel9", "product_identification_helper": { "purl": "pkg:oci/bootc-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9" } } }, { "category": "product_version", "name": "rhelai3/bootc-gaudi-rhel9", "product": { "name": "rhelai3/bootc-gaudi-rhel9", "product_id": "rhelai3/bootc-gaudi-rhel9", "product_identification_helper": { "purl": "pkg:oci/bootc-gaudi-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9" } } }, { "category": "product_version", "name": "rhelai3/bootc-rocm-rhel9", "product": { "name": "rhelai3/bootc-rocm-rhel9", "product_id": "rhelai3/bootc-rocm-rhel9", "product_identification_helper": { "purl": "pkg:oci/bootc-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9" } } }, { "category": "product_version", "name": "rhelai3/disk-image-cuda-rhel9", "product": { "name": "rhelai3/disk-image-cuda-rhel9", "product_id": "rhelai3/disk-image-cuda-rhel9", "product_identification_helper": { "purl": "pkg:oci/disk-image-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/disk-image-cuda-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-autorag-rhel9", "product": { "name": "rhoai/odh-autorag-rhel9", "product_id": "rhoai/odh-autorag-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-autorag-rhel9?repository_url=registry.redhat.io/rhoai/odh-autorag-rhel9" } } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3", "product_id": "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9" }, "product_reference": "rhelai3/bootc-cuda-rhel9", "relates_to_product_reference": "red_hat_enterprise_linux_ai_(rhel_ai)_3" }, { "category": "default_component_of", "full_product_name": { "name": "rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3", "product_id": "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9" }, "product_reference": "rhelai3/bootc-gaudi-rhel9", "relates_to_product_reference": "red_hat_enterprise_linux_ai_(rhel_ai)_3" }, { "category": "default_component_of", "full_product_name": { "name": "rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3", "product_id": "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9" }, "product_reference": "rhelai3/bootc-rocm-rhel9", "relates_to_product_reference": "red_hat_enterprise_linux_ai_(rhel_ai)_3" }, { "category": "default_component_of", "full_product_name": { "name": "rhelai3/disk-image-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3", "product_id": "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9" }, "product_reference": "rhelai3/disk-image-cuda-rhel9", "relates_to_product_reference": "red_hat_enterprise_linux_ai_(rhel_ai)_3" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-autorag-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-autorag-rhel9" }, "product_reference": "rhoai/odh-autorag-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-45833", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" }, "discovery_date": "2026-06-12T16:02:16.927583+00:00", "flags": [ { "label": "vulnerable_code_not_in_execute_path", "product_ids": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-autorag-rhel9" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2488430" } ], "notes": [ { "category": "description", "text": "A flaw was found in the ChromaDB Python project. An authenticated attacker with UPDATE_COLLECTION permission could exploit a code injection vulnerability. By sending a malicious model repository to a specific API endpoint with trust_remote_code enabled, the attacker can execute arbitrary code on the server. This could lead to a complete compromise of the affected system.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromadb: ChromaDB: Arbitrary Code Execution via Code Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "This is a post-authentication ChromaDB FastAPI flaw: exploitation requires a valid user with UPDATE_COLLECTION and a crafted request that sets trust_remote_code: true on a malicious HuggingFace model. It is not unauthenticated remote code execution.\n\nRH AI products ship a vulnerable chromadb version but do not expose the Chroma FastAPI API as the default product surface. RHOAI AutoRAG uses Llama Stack with Milvus/pgvector; RHEL AI bootc images include chromadb as a library dependency, not a network-facing Chroma server. Without a customer or misconfiguration that runs and exposes the Chroma Python server to untrusted users, the upstream attack path is not reachable.\n\nUpstream CVSS 9.4 Critical assumes network access to Chroma’s API with exploitable permissions. That does not match default RHOAI/RHEL AI architecture, so Important is the appropriate RH impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9" ], "known_not_affected": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-autorag-rhel9" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-45833" }, { "category": "external", "summary": "RHBZ#2488430", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488430" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45833", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45833" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45833", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45833" }, { "category": "external", "summary": "https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-5", "url": "https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-5" } ], "release_date": "2026-06-12T15:16:33.238000+00:00", "remediations": [ { "category": "workaround", "details": "To mitigate this issue, ensure that the `trust_remote_code` setting in ChromaDB is disabled. This setting prevents the execution of arbitrary code from remote model repositories. Consult ChromaDB documentation for specific configuration instructions to disable `trust_remote_code`. If the ChromaDB service is restarted or reloaded, verify that the setting remains disabled.", "product_ids": [ "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9" ] }, { "category": "no_fix_planned", "details": "Will not fix", "product_ids": [ "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-autorag-rhel9" ] } ], "threats": [ { "category": "impact", "details": "Important", "product_ids": [ "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gaudi-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9", "red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/disk-image-cuda-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-autorag-rhel9" ] } ], "title": "chromadb: ChromaDB: Arbitrary Code Execution via Code Injection" } ] }