Vulnerability · Published Jan 30, 2026 · Assigned by ProgressSoftware
CVE-2025-6723Untrusted user data can lead to privilege escalation
Medium 5.8
In plain English
A medium-severity privilege mismanagement in Chef Inspec from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere with the pipe connection process and exploit the insufficient access restrictions to assume the InSpec execution context, potentially resulting in elevated privileges or operational disruption. This issue affects Chef Inspec: through 5.23 and before 7.0.107
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | Chef Inspec | 0 – through <=5.23, <7.0.107 |
Weakness: CWE-269, CWE-287 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N