CVE-2026-80462
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.
Risk Assessment
An unauthenticated attacker could gain access to protected functionality, potentially leading to a breach of confidentiality, integrity, or availability. This risk affects organizations using Chef Automate.
Recommendation
Update Chef Automate to a version containing the fix for this vulnerability. Consider implementing additional authentication mechanisms and monitoring API access.
Other vulnerabilities in Chef Automate
See all- CVE-2025-8868Critical
In Progress Chef Automate (versions earlier than 4.13.295) on Linux x86, an authenticated attacker can gain access to restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.
- CVE-2025-6724High
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.
Original NVD description (English source)
A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS