CVE-2026-92782 chroma-core CVE debrief

Who should care

Defenders responsible for Chroma instances, security teams, and administrators of affected systems should assess exposure and prioritize remediation. This includes reviewing instance versions, restricting access to sensitive collections, and monitoring for suspicious activity. Security teams should also verify the official advisory for specific guidance on affected versions and patches.

Why it matters

CVE-2026-92782 allows authenticated attackers to access collections from other tenants, potentially leading to unauthorized data access and modification.

• Verify and update Chroma instances to prevent unauthorized access
• Restrict access to sensitive collections and tenant data
• Monitor for suspicious activity and implement additional logging and auditing

Technical summary

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks. This vulnerability affects Chroma instances and requires verification of instance versions and updates to prevent unauthorized access to sensitive data. The vulnerability is related to improper validation of tenant and database segments, which enables attackers to bypass authorization checks.

Defensive priority

Defenders should prioritize verifying and updating Chroma instances to prevent unauthorized access to sensitive data.

Recommended defensive actions

• Verify Chroma instance version and check for updates to 1.5.10 or later
• Restrict access to sensitive collections and tenant data
• Monitor for suspicious activity and implement additional logging and auditing
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the exact scope of affected versions and remediation steps require further verification from official sources. The vulnerability was reported and verified through official channels, and defenders should review the official advisory for specific guidance on affected versions and patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.