CVE-2026-8668
NoneCVSS
—
EPSS
0.3%
Published
Jun 18, 2026
CISA due date
—
The record
A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues. Queue messages contained tenant-specific identifiers. The credential has been rotated and replaced with per-tenant access in subsequent versions, eliminating this access method entirely.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-54784 CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET… CWE-523
- CVE-2026-36610 Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over… CWE-523
- CVE-2026-8673 Unprotected transport of credentials vulnerability in syslink software AG Avantra on… CWE-523
- CVE-2026-23635 Kiteworks is a private data network (PDN). CWE-523
- GHSA-vrjc-q2fh-6x9h Spinnaker vulnerable to SSRF due to improper restrictions on http from user input CWE-523
- CVE-2025-61916 Spinnaker is an open source, multi-cloud continuous delivery platform. CWE-523
- CVE-2025-66029 Open OnDemand provides remote web access to supercomputers. CWE-523
- CVE-2025-64309 The affected product discloses device telemetry, configuration, and sensitive information… CWE-523