What’s Vulnerable › Vulnerabilities
CVE-2025-8868: Chef Automate compliance service SQL Injection Vulnerability
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 25.9% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-09-29 · updated 2026-10-09
- Weakness: CWE-89
Description
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.
Affected products
- Progress Software Chef Automate: before 4.13.295; from 20180319150121 through 20220329091442 — fixed in 4.13.295
How to fix
Upgrade to a fixed version: Progress Software Chef Automate 4.13.295. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-8868 or the next vulnerability affects your stack