EUVD-2026-37956
GHSA-2q9w-rh4f-g84j
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:H/SI:N/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:L/U:X
PR:N because the static credential is the authentication mechanism itself; S:C and C:H reflect cross-tenant confidentiality breach via message queue.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
Lifecycle Timeline
2DescriptionCVE.org
A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues. Queue messages contained tenant-specific identifiers. The credential has been rotated and replaced with per-tenant access in subsequent versions, eliminating this access method entirely.
AnalysisAI
Hardcoded static credentials in Chef 360 prior to v1.7.0 exposed internal message queue infrastructure to unauthorized network access, disclosing tenant-specific identifiers across the multi-tenant platform. The credential was embedded in the product itself, making it accessible to any party with possession of the software. Progress Chef confirmed the issue and eliminated the static credential entirely in v1.7.0 by replacing it with per-tenant access controls. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental vector flags this as automatable (AU:Y) with proof-of-concept exploit maturity (E:P), elevating its realistic urgency beyond the low base score of 2.3.
Technical ContextAI
Chef 360 is a SaaS-adjacent infrastructure automation platform by Progress Software (CPE: cpe:2.3:a:progress_chef:chef360:*:*:*:*:*:*:*:*). The platform uses internal message queues to coordinate workloads across tenants, and the affected versions embedded a single shared static credential for queue access - a classic hardcoded credential anti-pattern. The assigned CWE is CWE-523 (Unprotected Transport of Credentials), which technically describes credentials transmitted without encryption; however, the root cause here more precisely aligns with CWE-798 (Use of Hard-coded Credentials), which covers credentials baked into source code or binaries. This is a notable CWE misclassification: the issue is credential embedding, not transport layer protection. The subsequent-system confidentiality impact (SC:H in the CVSS 4.0 vector) reflects cross-tenant exposure - message queue contents included tenant-specific identifiers that belong to isolated tenants, meaning exploitation breaches the multi-tenancy boundary.
RemediationAI
Vendor-released patch: Chef 360 v1.7.0. Organizations should upgrade to v1.7.0 or later immediately, as this version eliminates the static credential entirely and replaces it with per-tenant access controls, removing the attack surface at its root. Refer to the Progress Chef release notes at https://docs.chef.io/release_notes/360/ for upgrade procedures. If an immediate upgrade is not feasible, compensating controls should include network-level isolation of the message queue infrastructure - specifically, restrict inbound access to message queue ports to only known, authorized Chef 360 service IPs via firewall or security group rules. This reduces the exploitable network surface but does not eliminate the credential risk for any system already within the allowed network segment. Additionally, audit message queue access logs for unexpected authentication events using the static credential, which would indicate prior exploitation. Note that the static credential has been rotated by the vendor as part of the v1.7.0 release, so the specific hardcoded value is no longer valid in patched deployments.
Same weakness CWE-523 – Unprotected Transport of Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today