CVE-2026-8668

LowCVSS 2.3

Published: 18/06/2026(UTC)Updated: 26/10/2026(UTC)Translated: 23/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues. Queue messages contained tenant-specific identifiers.

Risk Assessment

Organizations could have been exposed to the disclosure of sensitive tenant information, potentially leading to privacy breaches and data security issues.

Recommendation

It is recommended to upgrade to at least Chef 360 version 1.7.0 to eliminate this vulnerability and ensure proper access controls.

Other vulnerabilities in Chef 360

CVE-2026-8100High
A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific conditions. This issue is due to improper handling of URL-encoded paths during request processing.

Original NVD description (English source)

A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues. Queue messages contained tenant-specific identifiers. The credential has been rotated and replaced with per-tenant access in subsequent versions, eliminating this access method entirely.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS