CVE-2026-80462

Progress (Chef) has disclosed a critical authentication flaw, classified as CWE-306 (missing authentication for critical function), in the Chef Automate API gateway and its identity validation path. Under specific conditions, an unauthenticated remote actor can send requests that bypass identity validation and gain elevated access to protected Chef Automate functionality; the scope-changed CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) indicates impact can extend beyond the gateway itself, with high confidentiality, integrity, and availability impact. Any organization running Chef Automate is affected, with the greatest risk for deployments whose API gateway is reachable from untrusted or internet-facing networks, though the vendor notes exploitation requires specific conditions. There is no public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation is currently known.

What to do: Upgrade Chef Automate to the fixed release specified in the Progress/Chef security advisory as soon as it is published (exact affected/fixed versions are not listed in the available data). Until patched, restrict access to the Automate API gateway to trusted networks or VPN, verify it is not exposed to the internet, and review logs for unauthenticated requests against protected API endpoints. Given the CVSS 10.0 rating, prioritize patching any deployment with an externally reachable gateway.