S4E just found a medium-severity finding from [ai] private ip disclosure detection scanner

CVE

CVE-2025-8868

8.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

chef automate

Updated Sep 18, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2025-8868 Scanner

CVE-2025-8868 Scanner - SQL Injection vulnerability in Chef Automate

Used 3.3k times · 5.9k assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: chef automate

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →