Vulnerability · Published Sep 11, 2026 · Assigned by ProgressSoftware
CVE-2026-80462Privilege Escalation in Progress Chef Automate
Critical 10.0
In plain English
A critical-severity missing authentication in Chef Automate from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)2.0%top 19.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei
Official description
A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | Chef Automate | 4.13.516 – before 4.13.520 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H