PT-2026-50804 · Progress Chef · Chef360

Publicado 2026-06-18 · Atualizado 2026-06-18 · CVE-2026-8668

Mitre

CVSS v4.0

2.3

Baixa

Vetor base

AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:H/SI:N/SA:L/E:P/S:N/AU:Y/RE:L

A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues.  Queue messages contained tenant-specific identifiers.  The credential has been rotated and replaced with per-tenant access in subsequent versions, eliminating this access method entirely.

Correção

Enumeração de Fraquezas

CWE-523

Identificadores relacionados

CVE-2026-8668

Produtos afetados

Chef360

Referências · 2

• https://docs.chef.io/release_notes/360 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-8668 · Nota de Segurança