Chef Automate API Gateway - Authentication Bypass
CVE-2026-80462
Verified
Description
Chef Automate derives an internal service identity from an X.509 certificate supplied in a request header without verifying its issuer. The load balancer blanks X-Client-Cert but does not strip the Grpc-Metadata- prefixed variants, which grpc-gateway rewrites into the metadata key the gateway's auth middleware reads. A remote unauthenticated attacker can present a self-signed certificate naming an internal service such as deployment-service and be authenticated as that service.
Severity
Critical
CVSS Score
10
Exploit Probability
2%
Affected Product
chef_automate
Published Date
October 13, 2026
Template Author
wong-hau-pepelu
CVE-2026-80462.yaml
10.0Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2026-80462
CWE ID:
cwe-306
Remediation Steps
Upgrade to Chef Automate 4.13.520 or later, which adds x509 chain verification to the header certificate path and strips the Grpc-Metadata prefixed headers at the load balancer. As an independent mitigation, blank Grpc-Metadata-Grpcgateway-X-Client-Cert, Grpc-Metadata-X-Client-Cert and X-Client-Cert at any proxy in front of Automate, repeating the directives in every location block that proxies to the gateway.