This vulnerability in Chef Automate's API gateway and identity validation path (CWE-306) allows an unauthenticated attacker to bypass authentication controls under specific conditions, resulting in elevated access to protected Chef Automate functions. The affected versions are from 4.13.516 up to but not including 4.13.520. The CVSS 3.1 score is 10.0, indicating critical severity with network attack vector, no privileges required, no user interaction, and complete confidentiality, integrity, and availability impact.

An unauthenticated attacker can gain elevated privileges within Chef Automate, potentially compromising confidentiality, integrity, and availability of the system. This could lead to full control over protected functionalities without any authentication, posing a severe risk to affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a fix is available, restrict access to the Chef Automate API gateway to trusted networks and monitor for suspicious activity related to authentication bypass attempts.