CVE-2026-8668 — Hardcoded credentials in embedded content

CVE-2026-8668

Hardcoded credentials in embedded content PUBLISHED

Description (CNA)

A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues. Queue messages contained tenant-specific identifiers. The credential has been rotated and replaced with per-tenant access in subsequent versions, eliminating this access method entirely.

Affected (CNA)

Vendor / product	Versions
Progress Chef / Chef360	affected 0 before 1.7.1

CWE

CWE-523

References

https://docs.chef.io/release_notes/360/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.