Alta

Salt has minion event bus authorization bypass vulnerability

Publicada: 13.06.2025
Actualizado: 11.10.2026 13:18

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	salt	>= 3007.0, < 3007.4, >= 3006.0, < 3006.12	3007.4, 3006.12

Referencias

Puntuación CVSS 8.1/10

Vector CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Debilidad (CWE): CWE-287
Plataforma: Python (PyPI)
Paquete: salt
Publicada: 13.06.2025
Actualizado: 11.10.2026 13:18

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2026-1899 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-jh7c-xh74-h76f - CC BY 4.0

Historial de vulnerabilidades: salt

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (69) en el archivo

Entradas en total: 69
Primera → última: 11.2013 01.2026
Sin corrección: 0
Explotada en ataques: 3

Distribución por gravedad

Crítica 17
Alta 32
Media 16
Baja 2
Sin evaluar 2

Divulgaciones por año

2017: 14
2018: 3
2019: 1
2020: 6
2021: 14
2022: 6
2023: 3
2024: 3
2025: 9
2026: 2

antes: 8

30.01.2026

Salt Authentication Protocol Version Downgrade Allows Minion Impersonation

Alta · 6.2 CVE-2025-62349 >= 3006.12, < 3006.17, >= 3007.4, < 3007.9 3006.17, 3007.9
30.01.2026

Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload

Alta · 7.8 CVE-2025-62348 < 3006.17 3006.17
13.06.2025

Salt vulnerable to directory traversal attack in file receiving method

Crítica · 9.6 CVE-2024-38824 >= 3006.0rc1, < 3006.12, >= 3007.0rc1, < 3007.4 3006.12, 3007.4
13.06.2025

Salt vulnerable to arbitrary event injection

Alta · 8.1 CVE-2025-22239 >= 3006.0rc1, < 3006.12, >= 3007.0rc1, < 3007.4 3006.12, 3007.4
13.06.2025

Salt has minion event bus authorization bypass vulnerability esta entrada

Alta · 8.1 CVE-2025-22236 >= 3007.0, < 3007.4, >= 3006.0, < 3006.12 3007.4, 3006.12
27.06.2024

Path traversal in saltstack

Alta · 7.7 CVE-2024-22232 < 3005.5, >= 3006.0, < 3006.6 3005.5, 3006.6
05.09.2023

Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environ

Alta · 7.8 CVE-2023-20898 >= 3006.0, < 3006.2, < 3005.2 3006.2, 3005.2
23.06.2022

Salt's PAM auth fails to reject locked accounts

Alta · 7.5 CVE-2022-22967 < 3002.9, >= 3003.0, < 3003.5, >= 3004.0, < 3004.2 3002.9, 3003.5, 3004.2
05.05.2022

SaltStack RSA Key Generation allows remote users to decrypt communications

Alta · 8.1 CVE-2013-2228 < 0.15.1 0.15.1
29.03.2022

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbit

Alta · 8.8 CVE-2022-22934 < 3002.8 3002.8
29.03.2022

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any

Alta · 8.8 CVE-2022-22941 < 3002.8 3002.8
29.03.2022

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying

Alta · 8.8 CVE-2022-22936 < 3002.8 3002.8
08.09.2021

Improper Authentication in SaltStack Salt

Alta · 6.4 CVE-2021-22004 < 3003.3 3003.3
08.09.2021

Exposure of Resource to Wrong Sphere in salt

Alta · 7.5 CVE-2021-21996 < 3003.3 3003.3
23.04.2021

Command Injection in SaltStack Salt

Alta · 7.8 CVE-2021-31607 >= 2016.11.0, < 3003rc1 3003rc1
03.03.2021

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify

Alta · 7.8 CVE-2021-25315 < 3002.2 3002.2
27.02.2021

An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.

Alta · 9.1 CVE-2021-25282 < 2015.8.10, >= 2015.8.11, < 2015.8.13, >= 2016.3.0, < 2016.3.4, >= 2016.3.5, < 2016.3.6, >= 2016.3.7, < 2016.3.8, >= 2016.11.0, < 2016.11.3, >= 2016.11.4, < 2016.11.5, >= 2016.11.7, < 2016.11.10, >= 2017.7.0, < 2017.7.8, >= 2018.3.0rc1, < 2019.2.0rc1, >= 2019.2.0, < 2019.2.5, >= 2019.2.6, < 2019.2.8, >= 3000, < 3000.6, >= 3001, < 3001.4, >= 3002, < 3002.5 2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.0rc1, 2019.2.5, 2019.2.8, 3000.6, 3001.4, 3002.5
27.02.2021

In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.

Alta · 5.9 CVE-2020-28972 < 2015.8.10, >= 2015.8.11, < 2015.8.13, >= 2016.3.0, < 2016.3.4, >= 2016.3.5, < 2016.3.6, >= 2016.3.7, < 2016.3.8, >= 2016.11.0, < 2016.11.3, >= 2016.11.4, < 2016.11.5, >= 2016.11.7, < 2016.11.10, >= 2017.7.0, < 2017.7.8, >= 2018.3.0rc1, < 2019.2.0rc1, >= 2019.2.0, < 2019.2.5, >= 2019.2.6, < 2019.2.8, >= 3000, < 3000.6, >= 3001, < 3001.4, >= 3002, < 3002.5 2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.0rc1, 2019.2.5, 2019.2.8, 3000.6, 3001.4, 3002.5
27.02.2021

An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API re

Crítica · 9.8 CVE-2021-3197 < 2015.8.10, >= 2015.8.11, < 2015.8.13, >= 2016.3.0, < 2016.3.4, >= 2016.3.5, < 2016.3.6, >= 2016.3.7, < 2016.3.8, >= 2016.11.0, < 2016.11.3, >= 2016.11.4, < 2016.11.5, >= 2016.11.7, < 2016.11.10, >= 2017.7.0, < 2017.7.8, >= 2018.3.0rc1, < 2019.2.0rc1, >= 2019.2.0, < 2019.2.5, >= 2019.2.6, < 2019.2.8, >= 3000, < 3000.6, >= 3001, < 3001.4, >= 3002, < 3002.5 2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.0rc1, 2019.2.5, 2019.2.8, 3000.6, 3001.4, 3002.5
27.02.2021

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.

Crítica · 9.8 CVE-2021-25283 < 2015.8.10, >= 2015.8.11, < 2015.8.13, >= 2016.3.0, < 2016.3.4, >= 2016.3.5, < 2016.3.6, >= 2016.3.7, < 2016.3.8, >= 2016.11.0, < 2016.11.3, >= 2016.11.4, < 2016.11.5, >= 2016.11.7, < 2016.11.10, >= 2017.7.0, < 2017.7.8, >= 2018.3.0rc1, < 2019.2.0rc1, >= 2019.2.0, < 2019.2.5, >= 2019.2.6, < 2019.2.8, >= 3000, < 3000.6, >= 3001, < 3001.4, >= 3002, < 3002.5 2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.0rc1, 2019.2.5, 2019.2.8, 3000.6, 3001.4, 3002.5

Mostrar más (20) Mostrando 20 de 49

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación