Introduction
Attackers with valid credentials can access restricted compliance functions in Chef Automate, which may expose sensitive configuration and compliance data. The vulnerability affects enterprise environments that rely on Chef Automate for security and compliance automation, and affected deployments need immediate remediation.
About Progress Chef Automate: Progress Chef Automate is a widely used infrastructure automation and compliance management platform. Large enterprises use it to manage configuration, security, and compliance at scale. Progress Software, a major enterprise automation vendor, develops the product and acquired Chef in 2020. Chef Automate is deployed in thousands of organizations worldwide, where it runs critical automation and compliance functions across diverse IT environments.
Technical information
CVE-2025-8868 is a critical SQL injection vulnerability in the compliance service of Chef Automate. The flaw is present in all versions earlier than 4.13.295 on Linux x86. An authenticated attacker using well-known authentication tokens can submit improperly neutralized input to SQL commands. The compliance service does not adequately sanitize user input in certain SQL queries, so attackers can inject malicious SQL statements. This can result in unauthorized access to restricted compliance data or manipulation of compliance results.
The root cause is insufficient input validation and a lack of parameterization when the compliance service builds SQL queries. Attackers who have or can obtain well-known or default tokens can exploit the flaw to escalate privileges or extract sensitive information from the backend database. No public code snippets or detailed endpoint information are available yet.
Affected systems and versions
- Product: Progress Chef Automate
- Platform: Linux x86
- Affected Versions: All versions earlier than 4.13.295
- Fixed Version: 4.13.295 and later
- Vulnerable configuration: Any deployment of Chef Automate on Linux x86 prior to 4.13.295
Vendor security history
Progress Software has fixed similar vulnerabilities in Chef Automate and related products before. Notable examples include:
- CVE-2023-42658: Input validation flaw in Chef InSpec profile processing
- CVE-2023-40050: Code execution via malicious profile uploads
The vendor typically releases patches promptly and publishes detailed advisories. The repeated input validation issues suggest an ongoing weakness in this area, and the patch record shows a consistent response to it.
