# CVE-2026-80462: Progress Chef Automate API gateway authentication bypass

Source: https://junglewise.ai/threats/cve-2026-80462-progress-chef-automate-api-gateway-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-80462 · Severity: critical · CVSS 10 · Published 2026-09-11

Chef Automate is a configuration management and infrastructure automation platform used by enterprises to manage servers and applications at scale. A vulnerability in its API gateway's identity validation allows unauthenticated attackers to bypass authentication and gain full administrative access to the system, potentially enabling complete compromise of managed infrastructure.

Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-80462 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80462 being exploited in the wild.

**How severe is CVE-2026-80462?** Critical severity, with a CVSS score of 10, published 11 September 2026.

**Which products and versions are affected?** Progress Chef Automate <UNKNOWN>.

**Is there a fix for CVE-2026-80462?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-80462 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-80462?** Check whether you run Progress Chef Automate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authentication bypass vulnerability in the Chef Automate API gateway's identity validation logic. The flaw allows an unauthenticated actor to craft requests that bypass the authentication pathway and gain elevated privileges to protected API functionality. The vulnerability is network-reachable and requires no prior authentication or special privileges to exploit, though it may require specific conditions to be met. Successful exploitation grants attackers complete administrative access to Chef Automate, enabling them to modify configurations, execute arbitrary code on managed nodes, and compromise the entire infrastructure under management. A patch is expected to be available from Progress.

## Affected products

- Progress Chef Automate <UNKNOWN>

## Timeline

- 2026-09-11: disclosed
- 2026-08: advisory: Progress issued a critical security bulletin in August 2026

## References

- [https://community.progress.com/s/article/Critical-Security-Bulletin---August-2026---Chef-Automate-Security-Vulnerability](https://community.progress.com/s/article/Critical-Security-Bulletin---August-2026---Chef-Automate-Security-Vulnerability)