CVE-2026-8668 — Hardcoded credentials in embedded content
A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues. Queue messages contained tenant-specific identifiers. The…
Published: 2026-06-18 · CVSS: 2.3 · CVSS 4.0
A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues. Queue messages contained tenant-specific identifiers. The credential has been rotated and replaced with per-tenant access in subsequent versions, eliminating this access method entirely.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7