CTI · corroborated · 2026-09-12

Chef Automate Critical Vulnerability CVE-2026-80462 (CVSS 10.0)

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1059 Command and Scripting Interpreter Execution

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Chef Automate CVE-2026-80462 Unauthenticated API Exploitation
id: a7b8c9d0-e1f2-3456-abcd-567890123456
status: experimental
description: Detects exploitation of CVE-2026-80462 in Chef Automate API gateway allowing unauthenticated access and command execution
references:
  - https://www.securityonline.info/
  - https://thehackerwire.com/
author: Tia N. List
date: 2026-09-12
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  product: linux
  category: webserver
detection:
  selection_chef_api:
    cs-uri|contains:
      - '/api/v0/'
      - '/api/v1/'
      - '/chef-server/'
    cs-uri|contains:
      - 'automate'
  selection_chef_auth_bypass:
    cs-uri|contains:
      - '/api/v0/iam/token'
      - '/session'
    cs-method:
      - POST
  condition: selection_chef_api and selection_chef_auth_bypass
falsepositives:
  - Legitimate Chef Automate API usage
level: critical

References

• https://www.securityonline.info/
• https://thehackerwire.com/