Security Flaw in Chef 360 by Progress Software

CVE-2026-8100

What is CVE-2026-8100?

A significant security vulnerability has been discovered in Chef 360 that allows unauthorized access to protected API endpoints. This flaw stems from inadequate handling of URL-encoded paths, which may enable an authenticated user to bypass critical access controls and gain elevated privileges. The risk is particularly pertinent in configurations where vulnerable request patterns are executable. To mitigate this issue, users should promptly update to Chef 360 version 1.7.1 or later, which incorporates improved request validation and strict path normalization to enhance security measures.

References