Hoch

Salt has minion event bus authorization bypass vulnerability

Veröffentlicht: 13.06.2025
Aktualisiert: 11.10.2026 13:18

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

Plattform	Paket	Anfällige Versionen	Behoben in
Python (PyPI)	salt	>= 3007.0, < 3007.4, >= 3006.0, < 3006.12	3007.4, 3006.12

Verweise

CVSS-Wert 8.1/10

CVSS-Vektor: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Schwäche (CWE): CWE-287
Plattform: Python (PyPI)
Paket: salt
Veröffentlicht: 13.06.2025
Aktualisiert: 11.10.2026 13:18

Quellen und Lizenzen

OSV / GitHub Advisory Database - PYSEC-2026-1899 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-jh7c-xh74-h76f - CC BY 4.0

Schwachstellenhistorie: salt

Alle veröffentlichten Schwachstellen dieses Pakets (Python (PyPI)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (69) im Archiv

Einträge insgesamt: 69
Erste → letzte: 11.2013 01.2026
Ohne Fix: 0
In Angriffen ausgenutzt: 3

Verteilung nach Schweregrad

Kritisch 17
Hoch 32
Mittel 16
Niedrig 2
Nicht bewertet 2

Veröffentlichungen pro Jahr

2017: 14
2018: 3
2019: 1
2020: 6
2021: 14
2022: 6
2023: 3
2024: 3
2025: 9
2026: 2

früher: 8

Schweregrad: Kritisch 17 Hoch 32 Mittel 16 Niedrig 2 Nicht bewertet 2

30.01.2026

Salt Authentication Protocol Version Downgrade Allows Minion Impersonation

Hoch · 6.2 CVE-2025-62349 >= 3006.12, < 3006.17, >= 3007.4, < 3007.9 3006.17, 3007.9
30.01.2026

Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload

Hoch · 7.8 CVE-2025-62348 < 3006.17 3006.17
13.06.2025

Salt vulnerable to directory traversal attack in file receiving method

Kritisch · 9.6 CVE-2024-38824 >= 3006.0rc1, < 3006.12, >= 3007.0rc1, < 3007.4 3006.12, 3007.4
13.06.2025

Salt vulnerable to arbitrary event injection

Hoch · 8.1 CVE-2025-22239 >= 3006.0rc1, < 3006.12, >= 3007.0rc1, < 3007.4 3006.12, 3007.4
13.06.2025

Salt has minion event bus authorization bypass vulnerability dieser Eintrag

Hoch · 8.1 CVE-2025-22236 >= 3007.0, < 3007.4, >= 3006.0, < 3006.12 3007.4, 3006.12
27.06.2024

Path traversal in saltstack

Hoch · 7.7 CVE-2024-22232 < 3005.5, >= 3006.0, < 3006.6 3005.5, 3006.6
05.09.2023

Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environ

Hoch · 7.8 CVE-2023-20898 >= 3006.0, < 3006.2, < 3005.2 3006.2, 3005.2
23.06.2022

Salt's PAM auth fails to reject locked accounts

Hoch · 7.5 CVE-2022-22967 < 3002.9, >= 3003.0, < 3003.5, >= 3004.0, < 3004.2 3002.9, 3003.5, 3004.2
05.05.2022

SaltStack RSA Key Generation allows remote users to decrypt communications

Hoch · 8.1 CVE-2013-2228 < 0.15.1 0.15.1
29.03.2022

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbit

Hoch · 8.8 CVE-2022-22934 < 3002.8 3002.8
29.03.2022

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any

Hoch · 8.8 CVE-2022-22941 < 3002.8 3002.8
29.03.2022

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying

Hoch · 8.8 CVE-2022-22936 < 3002.8 3002.8
08.09.2021

Improper Authentication in SaltStack Salt

Hoch · 6.4 CVE-2021-22004 < 3003.3 3003.3
08.09.2021

Exposure of Resource to Wrong Sphere in salt

Hoch · 7.5 CVE-2021-21996 < 3003.3 3003.3
23.04.2021

Command Injection in SaltStack Salt

Hoch · 7.8 CVE-2021-31607 >= 2016.11.0, < 3003rc1 3003rc1
03.03.2021

CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify

Hoch · 7.8 CVE-2021-25315 < 3002.2 3002.2
27.02.2021

An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.

Hoch · 9.1 CVE-2021-25282 < 2015.8.10, >= 2015.8.11, < 2015.8.13, >= 2016.3.0, < 2016.3.4, >= 2016.3.5, < 2016.3.6, >= 2016.3.7, < 2016.3.8, >= 2016.11.0, < 2016.11.3, >= 2016.11.4, < 2016.11.5, >= 2016.11.7, < 2016.11.10, >= 2017.7.0, < 2017.7.8, >= 2018.3.0rc1, < 2019.2.0rc1, >= 2019.2.0, < 2019.2.5, >= 2019.2.6, < 2019.2.8, >= 3000, < 3000.6, >= 3001, < 3001.4, >= 3002, < 3002.5 2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.0rc1, 2019.2.5, 2019.2.8, 3000.6, 3001.4, 3002.5
27.02.2021

In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.

Hoch · 5.9 CVE-2020-28972 < 2015.8.10, >= 2015.8.11, < 2015.8.13, >= 2016.3.0, < 2016.3.4, >= 2016.3.5, < 2016.3.6, >= 2016.3.7, < 2016.3.8, >= 2016.11.0, < 2016.11.3, >= 2016.11.4, < 2016.11.5, >= 2016.11.7, < 2016.11.10, >= 2017.7.0, < 2017.7.8, >= 2018.3.0rc1, < 2019.2.0rc1, >= 2019.2.0, < 2019.2.5, >= 2019.2.6, < 2019.2.8, >= 3000, < 3000.6, >= 3001, < 3001.4, >= 3002, < 3002.5 2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.0rc1, 2019.2.5, 2019.2.8, 3000.6, 3001.4, 3002.5
27.02.2021

An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API re

Kritisch · 9.8 CVE-2021-3197 < 2015.8.10, >= 2015.8.11, < 2015.8.13, >= 2016.3.0, < 2016.3.4, >= 2016.3.5, < 2016.3.6, >= 2016.3.7, < 2016.3.8, >= 2016.11.0, < 2016.11.3, >= 2016.11.4, < 2016.11.5, >= 2016.11.7, < 2016.11.10, >= 2017.7.0, < 2017.7.8, >= 2018.3.0rc1, < 2019.2.0rc1, >= 2019.2.0, < 2019.2.5, >= 2019.2.6, < 2019.2.8, >= 3000, < 3000.6, >= 3001, < 3001.4, >= 3002, < 3002.5 2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.0rc1, 2019.2.5, 2019.2.8, 3000.6, 3001.4, 3002.5
27.02.2021

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.

Kritisch · 9.8 CVE-2021-25283 < 2015.8.10, >= 2015.8.11, < 2015.8.13, >= 2016.3.0, < 2016.3.4, >= 2016.3.5, < 2016.3.6, >= 2016.3.7, < 2016.3.8, >= 2016.11.0, < 2016.11.3, >= 2016.11.4, < 2016.11.5, >= 2016.11.7, < 2016.11.10, >= 2017.7.0, < 2017.7.8, >= 2018.3.0rc1, < 2019.2.0rc1, >= 2019.2.0, < 2019.2.5, >= 2019.2.6, < 2019.2.8, >= 3000, < 3000.6, >= 3001, < 3001.4, >= 3002, < 3002.5 2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.0rc1, 2019.2.5, 2019.2.8, 3000.6, 3001.4, 3002.5

Mehr anzeigen (20) 20 von 49 angezeigt

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden