Executive brief
Progress Chef 360 is a DevOps automation platform used to manage and secure corporate infrastructure. A security flaw in its API gateway could allow an authenticated user to bypass access controls and reach restricted administrative functions. This could lead to unauthorized changes to infrastructure configurations or exposure of sensitive system data.
Technical details
A path traversal vulnerability (CWE-23) exists in the Chef 360 API gateway (NGINX component) due to improper handling of URL-encoded paths during request processing. An authenticated attacker can use specifically crafted request patterns to bypass standard access control checks and gain elevated privileges. This allows access to protected API endpoints intended for higher-permissioned roles. The issue is resolved in version 1.7.1 by enforcing strict path normalization before authorization checks.
Affected products
- Progress Software Chef 360 < 1.7.1
Timeline
- 2026-06-18: disclosed
- 2026-06-18: advisory
- 2026-06-18: patched: Fixed in version 1.7.1