The vulnerability CVE-2026-8668 in Progress Chef Chef360 prior to v1.7.0 involves the use of a static credential that permitted unauthenticated access to internal message queues. These queues contained tenant-specific identifiers, potentially exposing sensitive information. The static credential was rotated and replaced with per-tenant access controls in subsequent versions, removing the vulnerability. The CVSS 4.0 base score is 2.3, indicating a low severity issue with network attack vector, high attack complexity, and limited impact on confidentiality, integrity, and availability.

The vulnerability allowed unauthenticated access to internal message queues via a static credential, exposing tenant-specific identifiers. However, the impact is limited as the CVSS score is low (2.3), indicating low confidentiality, integrity, and availability impact. There are no known exploits in the wild. The exposure is mitigated in versions 1.7.0 and later by rotating the credential and implementing per-tenant access controls.

Upgrade to Chef360 version 1.7.0 or later, where the static credential has been rotated and replaced with per-tenant access controls, eliminating this vulnerability. No other remediation level or patch information is provided. Patch status is not explicitly confirmed beyond the version change; users should verify with vendor advisories for current remediation guidance.