A static credential embedded in earlier versions of Progress Chef’s Chef360 enables unauthenticated access to internal message queues. These queues carry tenant‑specific identifiers, meaning an attacker can read sensitive data without proper authorization. The flaw is a form of hardcoded credential misuse (CWE‑523) that allows data disclosure and potential escalation of privileges within the system’s messaging layer.

The vulnerability affects Progress Chef:Chef360 versions prior to 1.7.0. The fix is included in 1.7.1 and later releases, where the credential has been rotated and per‑tenant access controls are enforced.

The CVSS score of 2.3 reflects a low to moderate severity with minimal impact on system integrity. Because the credential is static and publicly documented, an attacker who can reach the message queue interface can authenticate automatically, though no EPSS data is available and the issue is not listed in CISA’s KEV catalog. The likely attack vector involves remote connection to the internal queue service using the hardcoded credentials, enabling unauthorized read of tenant identifiers and related messages.