AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Progress SoftwareCVE-2026-80462

Progress Software Chef Automate: missing authentication

Progress Software

CVE-2026-80462 · Published Sep 11, 2026 · updated Sep 18, 2026

Critical10.0
Fix: upgrade to 4.13.520 or later
Progress Software advisory

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.

Affected versions

PackageAffectedFixed in
Chef Automate
Product
>= 4.13.516, < 4.13.5204.13.520
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-306

More Progress Software advisories

All Progress Software
High 7.7Sep 29Progress Telerik Fiddler Everywhere: missing authenticationCVE-2026-86158fixed in 8.2.0Medium 5.6Sep 29Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere...CVE-2026-86157fixed in 8.2.0High 8.1Sep 2Progress Software Telerik UI for ASP.NET AJAX: remote code executionCVE-2026-19219fixed in 2026.3.812High 7.5Sep 2Progress Software Telerik UI for ASP.NET AJAX: path traversalCVE-2026-18672fixed in 2026.3.812High 7.2Aug 17Progress Software ShareFile Storage Zones Controller: path traversalCVE-2026-16137no fix yetHigh 8.0Aug 17Progress Software ShareFile Storage Zones Controller: unsafe deserializationCVE-2026-16138no fix yet