CVE-2026-80462

Privilege Escalation in Progress Chef Automate

State: Published
Severity: 10.0 Critical
Published: Sep 11, 2026
Updated: Sep 18, 2026
Reserved: Aug 26, 2026

Description

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.

Scores

CVSS	Score	Vector	Source
3.1	10.0 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	ProgressSoftware

Weaknesses

CWE-306 Missing authentication for critical function

Affected Products

Product	Versions
Chef AutomateProgress Software	4.13.516 to before 4.13.520Affected 1.0.0 to before 4.13.516Not affected

References

https://community.progress.com/s/article/Critical-Security-Bulletin---August-2026---Chef-Automate-Security-Vulnerabilityvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.