CVE-2025-6724: Chef Automate

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.

Affected products

• Chef Automate: before 4.13.295 (fixed in 4.13.295); from 20180319150121, up to and including 20220329091442

Published 2025-09-29. Last modified 2026-10-09.