Chef Automate EUVD-2026-76099

Exploitation targets the Chef Automate API gateway / identity-validation path and requires network reachability to that gateway; per the CVSS vector it needs no authentication, no user interaction, and low complexity. The key limiting factor is the vendor's qualifier that elevated access is granted only 'under specific conditions' - the advisory implies a particular request path or deployment state is required rather than every default install, but the exact precondition is not detailed in the available data and must be confirmed against the Progress bulletin. Realistic risk is therefore highest for Automate instances whose API gateway is reachable from untrusted networks.

This is a genuine top-priority issue: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity, and availability impact and a scope change, and the root cause (missing authentication) is exactly the kind of flaw that is trivially automatable once understood. The one tempering signal is the vendor's own phrasing - access is granted 'under specific conditions' - which sits in tension with the AC:L/PR:N rating and suggests a particular configuration, code path, or request shape may be required rather than any default deployment; defenders should verify the precise preconditions against the Progress advisory. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no evidence of active exploitation yet; however, absence of a POC is not reassurance for a max-severity auth bypass in an internet-adjacent management plane, and any organization running Chef Automate should treat patching as urgent rather than waiting for exploitation signals.

An attacker who can reach the Chef Automate API gateway over the network sends a crafted request that satisfies or sidesteps the gateway's identity-validation logic without supplying valid credentials, and is treated as an authorized principal. With that elevated access they can read compliance and node data, alter automation configuration, or disrupt the service across the connected backend components. No public exploit code is identified at time of analysis.