CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2026-80462Public Exploit

Chef Automate - Authentication Bypass (CVE-2026-80462)

PublishedSep 11, 2026
First SeenOct 21, 2026
Last Seen
Reported
CVSS10.0
Progress
ProgressChef Automate
cicdenterprise_software

Description

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.

psychologyCrowdSec Analysis

CVE-2026-80462 is a critical authentication bypass vulnerability in Progress Chef Automate’s API gateway and identity validation path. Under specific conditions, unauthenticated attackers may gain elevated access to protected functionality, potentially compromising the confidentiality, integrity, and availability of affected systems.

CrowdSec has been tracking this vulnerability and its exploits since 20th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-80462 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target /api/v0/telemetry/config and send a forged internal-service certificate in the Grpc-Metadata-Grpcgateway-X-Client-Cert header to bypass authentication. The header can cause the API gateway to treat an unauthenticated caller as a privileged internal service.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2026-09-11
Rule Released2026-10-20

Related Weaknesses

CWE-306: Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References