---
id: 5202
title: "[CVE-2025-8868] Cooking an SQL Injection Vulnerability in Chef Automate"
cve: CVE-2025-8868
cvss: 8.8
severity: high
source_domain: xbow.com
source_url: "https://xbow.com/blog/cooking-an-sql-injection-vulnerability-in-chef-automate"
published_at: "2025-09-30T12:00:00Z"
tags: ["vulnerability-research", "devops", "sql-injection", "postgresql", "default-credentials", "chef-automate"]
phying_url: "https://phying.com/item/5202"
lang: en
---

# [CVE-2025-8868] Cooking an SQL Injection Vulnerability in Chef Automate

## Summary

Details an SQL injection in Chef Automate found via a little-known default data-collector token, letting authenticated attackers run arbitrary SQL against its PostgreSQL database.

## Intelligence Metadata

- **Sources:** xbow.com
- **CVE:** CVE-2025-8868
- **CVSS:** 8.8
- **Published:** 2025-09-30T12:00:00Z
- **Original:** https://xbow.com/blog/cooking-an-sql-injection-vulnerability-in-chef-automate
- **Phying News:** https://phying.com/item/5202