CVE-2025-8868: chef automate SQL Injection
CVSS: 9.8v3.1CriticalAnalyzed
Published 29-09-2025Last modified 29-09-2025
Vulnerability summary
CVE-2025-8868 is a critical (CVSS 9.8) SQL Injection vulnerability in chef automate. EPSS estimates a 25.95% chance of exploitation in the next 30 days, higher than 97.9% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
25.95%
0%100%
High · +1.63 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 29-09-2025PublishedVulnerability first disclosed.
- 29-09-2025Last modifiedVulnerability information updated.
Description
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.
CVSS metrics
2 scores · 2 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources2 sources · 8.8–9.8
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
25.95%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
+1.63 pp
From 24.32% on 20-09-2026
20-09-202620-10-2026
EPSS score25.95%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Chef1 product
- automate< 4.13.295 | ≥ 20180319150121, ≤ 20220329091442
Progress software1 product
- chef automate< 4.13.295
2 vendors · 2 products