CVE-2025-6723

Untrusted user data can lead to privilege escalation

State: Published
Severity: 5.8 Medium
Published: Jan 30, 2026
Updated: Mar 11, 2026
Reserved: Jun 26, 2025

Description

Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially resulting in elevated privileges or operational disruption.

This issue affects Chef Inspec: through 5.23 and before 7.0.107

Scores

CVSS	Score	Vector	Source
4.0	5.8 Medium	CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N	ProgressSoftware

Weaknesses

CWE-269 Improper Privilege Management
CWE-287 Improper Authentication

Affected Products

Product	Versions
Chef InspecProgress Software	<=5.23, <7.0.107 and earlierAffected

References

https://docs.chef.io/inspec/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.