Chef

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Chef records in CISA KEV

No Chef vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Automate 3 records HIGH Chef 1 record LOW Chef Manage 1 record MEDIUM Inspec 1 record MEDIUM

Records

3 records in Automate · all components

TI-2025-08118 CVE-2025-8868 · GHSA-mh28-g8jv-r635

Chef Automate compliance service SQL Injection Vulnerability

HIGH 71

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized i…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.27849 Published 2025-09-29 Fixed in 4.13.295 CWE-200

TI-2023-20940 CVE-2023-40050 · GHSA-7fj6-6m8r-4v8h

Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application

MEDIUM 46

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01458 Published 2023-10-31 No fix listed CWE-434

TI-2025-06107 CVE-2025-6724 · GHSA-hj5c-r9rg-h7g3

Chef Automate SQL Injection Vulnerability

MEDIUM 40

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00375 Published 2025-09-29 Fixed in 4.13.295 CWE-89

Open these records in search →

Critical	3
High	3
Medium	0
Low	0
No CVSS	0