CVE-2026-80462

Privilege Escalation in Progress Chef Automate

Published Sep 11, 2026 CVSS 3.1 · 10 Critical EPSS 2.0% KEV · Not listed

Description

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.

Analysis

Technical impact

This flaw, representing a CWE-306 authentication bypass, occurs in the Chef Automate API gateway and identity validation path, allowing an unauthenticated actor to gain elevated access to protected functionality under specific conditions. The vulnerability enables bypassing authentication controls, allowing the attacker to execute privileged operations that could compromise system integrity, confidentiality, and availability.

Affected Systems

Progress Software Chef Automate versions 4.13.516 through 4.13.519 are affected. Versions prior to 4.13.516 are not affected, and upgrades to 4.13.520 or later contain the fix.

Risk and Exploitability

The CVSS score of 10 signals a critical vulnerability. The EPSS score of 2% indicates a low exploitation probability, and the issue is not listed in CISA KEV, suggesting no known active exploitation campaigns. The likely attack vector would be via the specific conditions required for the breach, which are not detailed in the description.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Progress Software

Chef Automate

unaffected

Version	Status	Constraints
`4.13.516`	affected	< 4.13.520
`1.0.0`	unaffected	< 4.13.516

No data.

Vendor Product Versions

Progress Software

Chef Automate

Version	Status	Scheme	Platform
`[4.13.516,4.13.520)`	affected	semver	['linux', 'x86']
`[1.0.0,4.13.516)`	unaffected	semver	['linux', 'x86']

Remediation

Vendor Solution

Customers should upgrade to Chef Automate 4.13.520 or subsequent version. Versions prior to 4.13.516 are NOT affected.

Vendor Workaround

No approved workaround is currently available. Progress recommends upgrading to the fixed release when available.

OpenCVE Recommended Actions

Install the fix by upgrading to Chef Automate 4.13.520 or later.
Restrict network access to the API gateway so that only trusted hosts can reach it, reducing exposure to unauthenticated actors.
Implement continuous monitoring of audit logs for potential exploitation attempts.
Validate that the API gateway strictly requires authentication before granting privileged operations.

Generated by OpenCVE AI on October 17, 2026 at 09:30 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.0% (2.006% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://community.progress.com/s/article/Critical-Security-Bulletin---August-2026---Chef-Automate-Security-Vulnerability

History

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Progress Software Progress Software chef Automate
Vendors & Products		Progress Software Progress Software chef Automate

Sep 11, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 11, 2026 12:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.
Title		Privilege Escalation in Progress Chef Automate
Weaknesses		CWE-306
References		https://community.progress.com/s/article/Critical-Security-Bulletin---August-2026---Chef-Automate-Security-Vulnerability
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`