CVE-2026-8668: Hardcoded credentials in embedded content
A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues. Queue messages contained tenant-specific identifiers. The credential has been rotated and replaced with per-tenant access in subsequent versions, eliminating this access method entirely.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chef 360to a version that resolves this vulnerability.Fixed in 1.7.1 - Operational
Rotate the static hardcoded credential that was embedded in Chef 360 prior to v1.7.0, since it previously allowed unauthenticated access to internal message queues.
Event History
Frequently Asked Questions
What is CVE-2026-8668?
CVE-2026-8668 refers to a vulnerability involving hardcoded credentials in Chef 360 prior to v1.7.0, allowing unauthenticated access to internal message queues.
What is the severity of CVE-2026-8668?
The severity of CVE-2026-8668 is classified as low with a CVSS score of 4.0.
How do I fix CVE-2026-8668?
To fix CVE-2026-8668, upgrade Chef 360 to version 1.7.0 or later where the hardcoded credentials issue has been addressed.
What impact does CVE-2026-8668 have on my system?
CVE-2026-8668 can allow unauthorized users to access tenant-specific identifiers through internal message queues.
Is CVE-2026-8668 still a risk in newer versions of Chef?
No, CVE-2026-8668 is not a risk in versions of Chef 360 after 1.7.0 as the hardcoded credentials have been removed and replaced with secure per-tenant access.