ChromaDB Vector Database Vulnerability Enables Unauthenticated Metadata Filter SQL Injection and Host Takeover (CVE-2026-78110)

Executive Lead & Threat Context

The open-source maintainers of ChromaDB, one of the most widely deployed open-source vector databases powering Enterprise Retrieval-Augmented Generation (RAG) architectures, have issued an emergency security patch addressing a critical flaw tracked as CVE-2026-78110 (CVSS 9.4). The vulnerability allows unauthenticated remote adversaries querying the database API to escape metadata filters and execute arbitrary commands on the underlying host operating system.

Because ChromaDB instances are commonly deployed alongside large language model (LLM) orchestration pipelines such as LangChain, LlamaIndex, and AutoGen to index proprietary enterprise knowledge bases, exploitation exposes corporate document embeddings, customer records, and API tokens to instantaneous exfiltration.

Vulnerability Mechanics: AST Compiler Bypass to SQLite Injection (CWE-89 / CWE-94)

ChromaDB supports complex metadata filtering during nearest-neighbor vector similarity queries using MongoDB-style dictionary expressions (e.g., {"department": {"$eq": "finance"}}). When parsing nested operators such as $and, $or, and custom regex expressions, ChromaDB's internal query builder compiles these dictionary trees into SQLite WHERE clauses for execution against local storage or distributed coordinator nodes.

Security researchers discovered that string sanitization within the $regex and $contains metadata operators failed to properly escape single quotes and semicolon delimiters when constructing dynamic SQL statements. An attacker can submit a crafted query payload that terminates the existing SQL clause, creates a SQLite in-memory loadable extension, and executes arbitrary shell commands:

POST /api/v1/collections/enterprise-docs/query HTTP/1.1
Host: chromadb.internal:8000
Content-Type: application/json

{
  "query_embeddings": [[0.021, -0.145, 0.982, ...]],
  "n_results": 5,
  "where": {
    "category": {
      "$contains": "audit'); ATTACH DATABASE '/tmp/pwn.db' AS pwn; CREATE TABLE pwn.shell(cmd TEXT); --"
    }
  }
}

Furthermore, on installations where ChromaDB is configured with administrative privileges or running inside Docker containers without user-namespace remapping, the injection allows the adversary to load malicious shared objects (.so) or overwrite system crontabs, achieving full interactive shell access.

Remediation Matrix & Hardening Playbook

AI platform engineers and DevSecOps teams must immediately take the following remediation actions:

1. Immediate Package Upgrade: Run pip install --upgrade chromadb across all AI microservice containers to deploy the patched Abstract Syntax Tree (AST) query compiler.
2. Network Perimeter Lockdown: Ensure ChromaDB default ports (TCP 8000) are never exposed to public ingress; enforce mutual TLS or internal VPC peering for all vector client connections.
3. Least-Privilege Containerization: Ensure ChromaDB daemons execute under dedicated non-root service accounts (chroot / non-root Docker user) with read-only root filesystems.