CVE-2011-5098
chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x...
chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the validation key and executing a knife client create command with the --admin option.
Exploit likelihood
What each source reports
NVD Score used
chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the validation key and executing a knife client create command with the --admin option.
- Record
CVE-2011-5098- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the validation key and executing a knife client create command with the --admin option.
- Record
CVE-2011-5098- Updated
- 2026-11-02
EUVDEUVD-2011-4998 No score
chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the validation key and executing a knife client create command with the --admin option.
- Record
EUVD-2011-4998- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q923-fjjc-9frg No score
chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x...
chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the validation key and executing a knife client create command with the --admin option.
- Record
GHSA-q923-fjjc-9frg- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-5098 is a medium vulnerability (CVSS 6.5) in Opscode Chef, published August 8, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.68%, the 77th percentile. No source names a fixed version.