# CVE-2026-80462: Chef Automate - Authentication Bypass

> Live exploitation tracking for CVE-2026-80462 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-80462

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Progress Chef Automate
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function)
- **Tags:** cicd, enterprise_software

## Description

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.

## CrowdSec analysis

[CVE-2026-80462](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-80462) is a critical authentication bypass vulnerability in Progress Chef Automate’s API gateway and identity validation path. Under specific conditions, unauthenticated attackers may gain elevated access to protected functionality, potentially compromising the confidentiality, integrity, and availability of affected systems.

CrowdSec has been tracking this vulnerability and its exploits since 20th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-80462 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target `/api/v0/telemetry/config` and send a forged internal-service certificate in the `Grpc-Metadata-Grpcgateway-X-Client-Cert` header to bypass authentication. The header can cause the API gateway to treat an unauthenticated caller as a privileged internal service.

## Timeline

- 2026-09-11: CVE Published. CVE-2026-80462 is published to NVD.
- 2026-10-20: Rule Released. CrowdSec releases a rule to detect CVE-2026-80462 exploitation attempts against the CrowdSec Network.
- 2026-10-21: First exploitation attempt seen by CrowdSec

## References

- https://community.progress.com/s/article/Critical-Security-Bulletin---August-2026---Chef-Automate-Security-Vulnerability
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-80462.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-80462) follows observed exploitation activity for CVE-2026-80462. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.