CVE-2026-8668

Deferred Deferred - Pending Action

Chef 360 Static Credential in Message Queue

Publication date: 2026-06-18

Last updated on: 2026-06-22

Assigner: Progress Software Corporation

Description

A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues. Queue messages contained tenant-specific identifiers. The credential has been rotated and replaced with per-tenant access in subsequent versions, eliminating this access method entirely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-18

Last Modified

2026-06-22

Generated

2026-07-09

AI Q&A

2026-06-19

EPSS Evaluated

2026-07-08

NVD

CVE-2026-8668

EUVD

EUVD-2026-37956

Affected Vendors & Products

Vendor	Product	Version / Range
progress	chef	to 1.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-523	Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

Attack-Flow Graph

Impact Analysis

The vulnerability could allow unauthorized users to access internal message queues without authentication.

Since these queues contain tenant-specific identifiers, this could lead to exposure of sensitive tenant information or identifiers.

Such unauthorized access might compromise tenant data confidentiality and potentially lead to further security risks depending on the information accessed.

Mitigation Strategies

To mitigate this vulnerability, upgrade Chef 360 to version 1.7.0 or later, where the static credential has been rotated and replaced with per-tenant access, eliminating the unauthenticated access to internal message queues.

Executive Summary

This vulnerability involves a static credential embedded in Chef 360 versions prior to 1.7.0 that allowed unauthenticated access to internal message queues.

These message queues contained tenant-specific identifiers, meaning that unauthorized users could potentially access information related to different tenants.

The issue was addressed by rotating the static credential and replacing it with per-tenant access controls in later versions, which eliminated this unauthorized access method.

Compliance Impact

This vulnerability involves a static credential embedded in Chef 360 prior to version 1.7.0 that allowed unauthenticated access to internal message queues containing tenant-specific identifiers.

Because tenant-specific identifiers were exposed through this vulnerability, it could potentially impact compliance with data protection regulations such as GDPR or HIPAA, which require protection of personal and sensitive information.

However, the credential has been rotated and replaced with per-tenant access controls in subsequent versions, eliminating this access method entirely.

Hi! I’m here to help you understand CVE-2026-8668. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70