CVE-2025-8868
High · 8.8CVSS
8.8
EPSS
25.9%
Published
Sep 29, 2025
CISA due date
—
The record
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|