CVE-2026-80462

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions...

CVE-2026-80462 Privilege Escalation in Progress Chef Automate

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions...

EUVD-2026-76099

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions...

CVE-2026-80462 Privilege Escalation in Progress Chef Automate

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions...

CVE-2026-80462

Progress Chef Automate is affected by a privilege escalation vulnerability in its API gateway and identity validation path , allowing an unauthenticated network actor to gain elevated access to protected functionality under specific conditions. The vulnerability is rated CVSS 3.1 10.0 (Critical) ...

CVE-2026-80462: Missing Authentication for Critical Function

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions...

PT-2026-89866

👨‍🍳 Progress Chef Automate: CVSS 10 critical. CVE-2026-80462 lets unauthenticated actors escalate privileges via the API gateway identity validation path under specific conditions. Patch immediately. cybersecurity ciso vulnerabilities mssp https://t.co/oK7C8H5CtZ https://t.co/JFDGm3roK7...

CVE-2026-3416

The API Publisher component previously used a non-cryptographic pseudorandom number generator PRNG to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables...

CVE-2026-3416 Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads

The API Publisher component previously used a non-cryptographic pseudorandom number generator PRNG to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables...

EUVD-2026-70453

The API Publisher component previously used a non-cryptographic pseudorandom number generator PRNG to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables...

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

EUVD-2026-70056

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

Malicious Package

Overview cminhouse-api-gateway-nodejs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview bt2-api-gateway-node-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

MAL-2026-15815 Malicious code in cminhouse-api-gateway-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c42971bbb30a4cb0a1da27be3953339fdbda449e4d10e997aac72212df0a8b1d index.js is wired as the package's postinstall script and also runs on require via main. After skipping CI/test/Docker environments guards on...

Malicious code in cminhouse-api-gateway-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c42971bbb30a4cb0a1da27be3953339fdbda449e4d10e997aac72212df0a8b1d index.js is wired as the package's postinstall script and also runs on require via main. After skipping CI/test/Docker environments guards on...

CVE-2026-82955: Improper Certificate Validation

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...