Progress Software published a critical security bulletin, disclosing a maximum-severity flaw. The newly identified Chef Automate vulnerability allows unauthenticated attackers to gain elevated privileges. Consequently, administrators must update their environments immediately to prevent unauthorized infrastructure control. TL;DR A critical flaw in Chef Automate permits unauthenticated remote actors to gain administrative access. The vulnerability enables attackers to bypass identity checks and execute commands across managed systems.

The Chef Automate system’s API gateway and identity‑checking code can be tricked into treating anyone as a trusted user, giving them actions they should.