Platform
linux
Component
automate
Fixed in
4.13.295
CVE-2025-8868 is a critical SQL Injection vulnerability affecting the Chef Automate compliance service. This flaw allows an authenticated attacker to bypass security controls and potentially gain unauthorized access to sensitive data and functionality within Chef Automate. The vulnerability impacts versions prior to 4.13.295 running on Linux x86 platforms. A patch is available in version 4.13.295.
The SQL Injection vulnerability in Chef Automate allows an authenticated attacker to inject malicious SQL code into queries executed by the compliance service. Successful exploitation could lead to unauthorized data access, modification, or deletion. An attacker could potentially escalate privileges, gain control over Chef Automate resources, and compromise the entire infrastructure. The impact is particularly severe given Chef Automate's role in managing and enforcing configuration compliance across an organization's infrastructure. This could lead to widespread configuration drift and security vulnerabilities if exploited.
CVE-2025-8868 is currently not listed on the CISA KEV catalog. Public proof-of-concept exploits are not yet available, but the critical CVSS score suggests a high probability of exploitation if a suitable exploit is developed. The vulnerability was publicly disclosed on 2025-09-29.
Exploit Status
EPSS
13.85% (94% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-8868 is to immediately upgrade Chef Automate to version 4.13.295 or later. If upgrading is not immediately feasible, consider implementing stricter input validation and sanitization within the compliance service to prevent SQL injection attacks. While not a complete solution, employing a Web Application Firewall (WAF) with SQL injection protection rules can provide an additional layer of defense. Review and restrict access to the Chef Automate compliance service to limit the potential attack surface.
Update Chef Automate to version 4.13.295 or later. This update fixes the SQL Injection vulnerability in the compliance service. See the release notes at https://docs.chef.io/release_notes_automate/#4.13.295 for more details.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-8868 is a critical SQL Injection vulnerability in Chef Automate compliance service versions 0–4.13.294, allowing authenticated attackers to gain unauthorized access.
Yes, if you are running Chef Automate versions 0–4.13.294 on a Linux x86 platform, you are vulnerable to this SQL Injection flaw.
Upgrade Chef Automate to version 4.13.295 or later to remediate the vulnerability. Consider WAF rules as a temporary mitigation.
While no active exploitation has been confirmed, the critical severity suggests a high probability of exploitation if a suitable exploit is developed.
Refer to the official Chef Automate security advisory for CVE-2025-8868 on the Chef website.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.