Chef vulnerabilities
6 vulnerabilities
Known vulnerabilities in Chef products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
Products
4- Automate3 vulnerabilities
- Chef1 vulnerabilities
- Chef Manage1 vulnerabilities
- Inspec1 vulnerabilities
CVE-2015-8559chefchef+1
EPSS score1.93%
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages.CVE-2016-4326chefchef_manageEPSS score4.19%
The Chef Manage (formerly opscode-manage) add-on before 1.12.0 for Chef allows remote attackers to execute arbitrary code via crafted serialized data in a cookie.CVE-2025-6724chefautomate+1EPSS score0.38%
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.CVE-2025-8868chefautomate+1EPSS score25.95%
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via
improperly neutralized inputs used in an SQL command using a well-known token.CVE-2023-40050chefautomate+1EPSS score1.18%
Upload profile either
through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec
check command with maliciously crafted profile allows remote code execution.CVE-2023-42658chefinspec+1EPSS score0.28%
Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.