ADVISORY UNAUTH-2026-0018
TYPE exposure-class
PRODUCT Chroma
SEVERITY CRITICAL
Chroma vector database open without authentication
published 2026-08-05 · updated 2026-08-05
Why it matters
Your Chroma database answers anyone. Every embedding can be read, poisoned, or deleted. Embeddings usually contain document text and may hold agent memory (OWASP ASI06). Chroma runs without auth unless you configure it.
What a probe sees
GET :8000/api/v2/heartbeat answers {"nanosecond heartbeat": ...} and /api/v2/collections lists data — no auth.
Internet-facing exposure — observable from the public internet with GET-only probes (the same probes unauth.dev sends).
agent-memory-store OWASP ASI06
In the wild
HONEYPOT EVIDENCE · only unauth.dev publishes this
SERVICE chroma
PROBES (30d) 245
FIRST SEEN 2026-08-03
LAST SEEN 2026-08-05
Day-granularity probe counts from the unauth.dev botwatch honeypot (245 observed across retained history), refreshed monthly. No source IPs exist in the underlying data. Live view: /botwatch.
Fix it
References
- https://docs.trychroma.com/deployment/auth
- https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/
Cite this record
unauth.dev advisory UNAUTH-2026-0018 — observed 2026-08 · CC-BY 4.0
Canonical URL: https://unauth.dev/advisories/UNAUTH-2026-0018. This record is part of the unauth.dev advisory dataset, published under CC-BY 4.0: attribute "unauth.dev / Raúl Acedo". Schema: additive-only within v1; this id will never be renumbered or reused.