CVE-2025-8868
Critical
Description
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.
SeverityCritical
CVSS9.8
Exploit probability—
ProductChef Automate
PublishedSep 29, 2025
First seenSep 29, 2025
How to fix
Update
- chef automate4.13.295 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| chef automate | v < 4.13.295, 20180319150121 ≤ v ≤ 20220329091442 | 4.13.295 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.