CVE-2026-80462CWE-306

CVE-2026-80462

Critical · published September 11, 2026

CVSS v3.1
10.0
EPSS
2%
Percentile
80.7
In the wild
Unconfirmed
What it is

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02006 · 80.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-11T17:18Z
References (1)
https://community.progress.com/s/article/Critical-Security-Bulletin---August-2026---Chef-Automate-Security-Vulnerability · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 12:28Z
    Privilege Escalation in Progress Chef Automate
    cvelistv5