Overview
Chef Automate is the management and compliance console for Chef infrastructure. Its compliance service builds an SQL statement from request input without neutralizing it, and the request can be authenticated with a well-known token.
An attacker uses that token and the injection point to run their own SQL inside the compliance service database and reach functionality that is meant to be restricted. The CVE carries a CVSS 3.1 score of 9.8. Chef Automate 4.13.295 fixes the issue.
Affected products
- Progress Chef Automate before 4.13.295 on Linux x86
Disclosure timeline
- 02 Sep 2025
- Progress releases Chef Automate 4.13.295 with the fix
- 29 Sep 2025
- Progress publishes CVE-2025-8868
- 30 Sep 2025
- XBOW publishes the technical write-up