VULNERABILITY INTELLIGENCE

CVE-2025-8868

CVSS score9.8 CRITICAL
EPSS probability25.95%
CISA KEVNot currently listed
Published2025-09-29
Last modified2026-10-09
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.

Weakness classification

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references