CVE-2025-6724

Chef Automate SQL Injection Vulnerability

CVSS 8.8 HIGHEPSS 0.3%CWE-89

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Progress Software · Chef Automate

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://docs.chef.io/release_notes_automate/#4.13.295