CVE-2026-80462

CriticalCVSS 10.0/10Last modified Sep 18, 2026

Description

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Sep 11, 2026
Last modified
Sep 18, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-80463Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackeCVE-2026-804644.9Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue CVE-2026-804658.7A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All vCVE-2026-804678.1The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms tCVE-2026-804698.3An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verificCVE-2026-80477.5The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write.CVE-2026-80486.4The My Email Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subject' shortcode attribute in the 'my-emCVE-2026-804884.1The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in aCVE-2026-804895.9Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library versionCVE-2026-80495.3In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without an explicit SDDL security descriptor and without FCVE-2026-80490Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified. The matches, fiCVE-2026-804918.6The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several una
CVE-2026-80462: Critical severity, CVSS 10.0 | Vulnix