CVE-2025-8868 Chef Automate compliance service SQL Injection Vulnerability
An authenticated attacker can exploit SQL injection in the Chef Automate compliance service to access restricted functionality and read sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-8868?
CVE-2025-8868 is a critical SQL injection vulnerability in Progress Software Chef Automate, published on 29 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via
improperly neutralized inputs used in an SQL command using a well-known token.
Which versions are affected by CVE-2025-8868?
It affects 1 product.
Products include Chef Automate.
How do I fix CVE-2025-8868?
No fix has been published for CVE-2025-8868 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-8868 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-8868 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Progress Software Chef Automate
Sources
Also known as GHSA-mh28-g8jv-r635.