Vulnerabilities for salt

First version without a known vulnerability: 3006.17

Details

• GHSA-77w2-v593-vxvv2026-01-30

  Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload

  Fixed in: 3006.17

• GHSA-vcf3-26xf-fw4m2026-01-30

  Salt Authentication Protocol Version Downgrade Allows Minion Impersonation

  Fixed in: 3006.17, 3007.9

• GHSA-8pcp-r83j-fc922025-06-13

  Salt vulnerable to directory traversal attack in file receiving method

  Fixed in: 3007.4, 3006.12

• GHSA-989c-m532-p2hv2025-06-13

  Salt's worker process vulnerable to denial of service through file read operation

  Fixed in: 3007.4, 3006.12

• GHSA-4j59-vv55-q6h32025-06-13

  Salt's salt.auth.pki module does not properly authenticate callers

  Fixed in: 3006.12, 3007.4

• GHSA-7f3f-x5f5-79gw2025-06-13

  Salt's file contents overwrite the VirtKey class

  Fixed in: 3007.4, 3006.12

• GHSA-c46w-gr7f-jm2p2025-06-13

  Salt vulnerable to arbitrary event injection

  Fixed in: 3006.12, 3007.4

• GHSA-fcr4-h6c4-rvvp2025-06-13

  Salt's on demand pillar functionality vulnerable to arbitrary command injections

  Fixed in: 3006.12, 3007.4

• GHSA-jh7c-xh74-h76f2025-06-13

  Salt has minion event bus authorization bypass vulnerability

  Fixed in: 3007.4, 3006.12

• GHSA-r546-h3ff-q5852025-06-13

  Salt vulnerable to directory traversal attack in minion file cache creation

  Fixed in: 3006.12, 3007.4

• GHSA-xh32-3m67-qjgf2025-06-13

  Salt allows arbitrary directory creation or file deletion

  Fixed in: 3007.4, 3006.12

• GHSA-4277-m35q-7c9w2024-11-14

  Salt preflight script could be attacker controlled

  Fixed in: 3005.4, 3006.4

• GHSA-2qw3-2wv6-p64x2024-06-27

  Path traversal in saltstack

  Fixed in: 3005.5, 3006.6

• GHSA-q27c-j6j9-53w32024-06-27

  Directory creation by malicious user in saltstack

  Fixed in: 3005.5, 3006.6

• GHSA-qvh6-3j7x-3hq72023-09-05

  Salt can cause Git Providers to get wrong data

  Fixed in: 3005.2, 3006.2

• GHSA-vpjg-wmf8-29h92023-09-05

  Salt vulnerable to denial of service

  Fixed in: 3005.2, 3006.2

• PYSEC-2023-472023-02-17

  Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file.

  Fixed in: 3003.1

• GHSA-fpxm-fprw-6hxj2022-06-25

  Salt's PAM auth fails to reject locked accounts

  Fixed in: 3002.9, 3003.5, 3004.2

• GHSA-xf37-qcvf-7m572022-05-24

  Improper Authentication in SaltStack Salt

  Fixed in: 3003.3

• GHSA-hcjf-rp5h-g5h32022-05-24

  Command Injection in SaltStack Salt

  Fixed in: 3003rc1

• GHSA-pmj6-9f8c-8g2m2022-05-24

  Saltstack Salt Unauthenticated Arbitrary Code Execution

  Fixed in: 3002.2

• GHSA-8rp6-x3r7-5qw32022-05-24

  SaltStack Salt is vulnerable to shell injection via ProxyCommand argument

  Fixed in: 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.3, 2015.8.10, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2019.2.0rc1, 2019.2.5, 3000.6, 3001.4, 3002.5

• GHSA-ghc2-hx3w-jqmp2022-05-24

  SaltStack Salt command injection in the Salt-API when using the Salt-SSH client

  Fixed in: 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.3, 2015.8.10, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2019.2.0rc1, 2019.2.5, 3000.6, 3001.4, 3002.5

• GHSA-w2hr-3mc8-46gh2022-05-24

  SaltStack Salt eauth tokens can be used once after expiration

  Fixed in: 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 3000.7, 3001.5, 3002.3, 2019.2.8, 2015.8.10, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2019.2.0rc1, 2019.2.5, 3000.6, 3001.4, 3002.5

• GHSA-76x4-x3p6-rpr92022-05-24

  SaltStack Salt Directory Traversal vulnerability

  Fixed in: 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.3, 2015.8.10, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2019.2.0rc1, 2019.2.5, 3000.6, 3001.4, 3002.5

• GHSA-r55w-xph5-xvx22022-05-24

  SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod

  Fixed in: 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.3, 2015.8.10, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2019.2.0rc1, 2019.2.5, 3000.6, 3001.4, 3002.5

• GHSA-xgmh-gfxw-2hvv2022-05-24

  SaltStack Salt Server Side Template Injection

  Fixed in: 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.5, 2015.8.10, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2019.2.0rc1, 2019.2.5, 3000.6, 3001.4

• GHSA-xxw3-765m-f37p2022-05-24

  SaltStack Salt Improper Authentication vulnerability

  Fixed in: 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.3, 2015.8.10, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2019.2.0rc1, 2019.2.5, 3000.6, 3001.4, 3002.5

• GHSA-phhw-3wc9-8q752022-05-24

  SaltStack Salt command injection via a crafted process name

  Fixed in: 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.3, 2015.8.10, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2019.2.0rc1, 2019.2.5, 3000.6, 3001.4, 3002.5

• GHSA-qx72-q6w3-qgc72022-05-24

  SaltStack Salt Improper SSL Certificate Validation

  Fixed in: 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.3, 2015.8.10, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2019.2.0rc1, 2019.2.5, 3000.6, 3001.4, 3002.5

• GHSA-w589-r335-4f552022-05-24

  SaltStack Salt Improper Certificate Validation

  Fixed in: 2015.8.13, 2016.11.5, 2016.11.10, 2017.7.8, 2019.2.8, 3000.7, 3001.5, 3002.3, 2015.8.10, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2019.2.0rc1, 2019.2.5, 3000.6, 3001.4, 3002.5

• GHSA-29j3-2446-5j4w2022-05-24

  SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi

  Fixed in: 2015.8.13, 2016.3.8, 2016.11.10, 2017.7.8, 2018.3.5, 2019.2.7, 3000.5, 3001.3, 3002.1, 2015.8.10, 2016.3.4, 2016.3.6, 2016.11.3, 2016.11.6, 2017.7.4, 2019.2.5, 3000.3

• GHSA-qr38-h96j-2j3w2022-05-24

  SaltStack Salt Command Injection in netapi ssh client

  Fixed in: 2015.8.13, 2016.3.8, 2016.11.10, 2017.7.8, 2018.3.5, 2019.2.6, 3000.4, 3001.2, 3002.1, 2015.8.10, 2016.3.4, 2016.3.6, 2016.11.3, 2016.11.6, 2017.7.4, 2019.2.5, 3000.3

• GHSA-3c56-vx6v-q5vh2022-05-24

  SaltStack Salt Allows creating certificates with weak file permissions

  Fixed in: 2015.8.13, 2016.3.8, 2016.11.10, 2017.7.8, 2018.3.5, 2019.2.6, 3000.4, 3001.2, 3002.1, 2015.8.10, 2016.3.4, 2016.3.6, 2016.11.3, 2016.11.6, 2017.7.4, 2019.2.5, 3000.3

• GHSA-pjhf-vpx3-33r32022-05-24

  SaltStack Salt Unauthenticated Remote Code Execution

  Fixed in: 2019.2.4, 3000.2

• GHSA-vp49-2g4r-m3x32022-05-24

  SaltStack Salt is vulnerable Arbitrary Directory Access

  Fixed in: 2019.2.4, 3000.2

• GHSA-q53j-p6r2-g2v42022-05-24

  SaltStack Salt is vulnerable to command injection

  Fixed in: 2019.2.3, 2019.2.1

• GHSA-h8xp-h3jf-wv4v2022-05-24

  SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function

  Fixed in: 2018.3.4

• GHSA-7wx3-vr2f-6p292022-05-17

  SaltStack Privilege Escalation vulnerability

  Fixed in: 0.17.1

• GHSA-jmv9-5gx8-7xpf2022-05-17

  Minion identity not validated in saltstack

  Fixed in: 0.17.1

• GHSA-f22j-37jj-cxw92022-05-17

  SaltStack MITM SSH attack in salt-ssh

  Fixed in: 0.17.1

• GHSA-qr3x-v97p-42xw2022-05-17

  SaltStack insecurely uses /tmp

  Fixed in: 0.17.1

• GHSA-v89f-4mc4-h6w92022-05-17

  Salt has insufficient argument validation in several modules

  Fixed in: 0.17.1

• GHSA-v2rp-9cpj-pfw22022-05-17

  Salt Insecure configuration of PAM external authentication service

  Fixed in: 2015.5.10, 2015.8.8

• GHSA-hvmj-356c-gpf42022-05-17

  Salt allows deleted minions to read or write to minions with the same id

  Fixed in: 2015.8.11

• GHSA-6prw-8xhm-h2472022-05-17

  Salt uses weak permissions on the cache data

  Fixed in: 2015.8.3

• GHSA-6grp-75pq-c8cj2022-05-17

  SaltStack has insecure /tmp file handling in salt/modules/chef.py

  Fixed in: 2014.7.4, b49d0d4b5ca5c6f31f03e2caf97cef1088eeed81, 22d2f7a1ec93300c34e8c42d14ec39d51e610b5c

• GHSA-92pw-mff9-jqgm2022-05-17

  Salt improper handling of tmp files

  Fixed in: 2014.7.4, e11298d7155e9982749483ca5538e46090caef9c

• GHSA-xcx4-5wq7-g5g72022-05-17

  SaltStack Salt Information Exposure

  Fixed in: 2016.11.4

• GHSA-cxm4-7qcw-267r2022-05-17

  salt password information leaked in debug logs

  Fixed in: 2015.5.6, 2015.8.1, c0689e32154c41f59840ae10ffc5fbfa30618710

• GHSA-mfr3-9cj8-h2qm2022-05-17

  SaltStack Salt Insecure Temporary File Creation

  Fixed in: 2014.1.10

• GHSA-xxvj-8g5m-4qgw2022-05-17

  SaltStack Salt Directory traversal vulnerability in minion id validation

  Fixed in: 2016.11.7, 2017.7.1

• GHSA-f2h7-4f84-8qrm2022-05-17

  SaltStack Salt Authentication Bypass when using the local_batch client from salt-api

  Fixed in: 2015.8.13, 2016.3.5, 2016.11.2

• GHSA-q2x6-8gfj-hjxw2022-05-17

  salt leaks git usernames and passwords to the log

  Fixed in: 2015.5.5, 28aa9b105804ff433d8f663b2f9b804f2b75495a

• GHSA-j6gj-pg62-x8j62022-05-17

  SaltStack Salt Directory traversal vulnerability in minion id validation

  Fixed in: 2016.3.8, 2016.11.8, 2017.7.2, 80d90307b07b3703428ecbb7c8bb468e28a9ae6d

• GHSA-657p-cj5r-mjrh2022-05-17

  SaltStack Salt Denial of Service via a crafted authentication request

  Fixed in: 2016.3.8, 2016.11.8, 2017.7.2, 5f8b5e1a0f23fe0f2be5b3c3e04199b57a53db5b

• GHSA-8j9g-c9rp-jvg42022-05-14

  Salt vulnerable to Improper Certificate Validation

  Fixed in: 2014.7.6

• GHSA-vqh4-crjf-jjxx2022-05-14

  Salt Improper Access Control

  Fixed in: 2015.8.4

• GHSA-g283-88v5-rmq22022-05-13

  SaltStack Salt allows compromised salt-minions to impersonate the salt-master

  Fixed in: 2016.3.6

• GHSA-8r7r-x48r-pf8f2022-05-13

  SaltStack Salt arbitrary command execution in Salt-api via ssh_client

  Fixed in: 2015.8.13, 2016.3.5, 2016.11.2

• GHSA-jx34-pppm-gjvr2022-05-13

  SaltStack Salt Directory Traversal vulnerability in salt-api

  Fixed in: 2017.7.8, 2018.3.3, 2016.11.10

• GHSA-x549-r7m8-gv632022-05-13

  SaltStack Salt Remote command execution and incorrect access control when using salt-api

  Fixed in: 2017.7.8, 2018.3.3, 2016.11.10

• GHSA-gq26-cpq6-w85r2022-05-05

  SaltStack RSA Key Generation allows remote users to decrypt communications

  Fixed in: 0.15.1

• GHSA-2q4g-wfm6-5fpm2022-03-30

  SaltStack Improper Verification of Cryptographic Signature

  Fixed in: 3002.8, 3004.1, 3003.4

• GHSA-5r3f-3m3j-wcj22022-03-30

  SaltStack Salt Authentication Bypass by Capture-replay

  Fixed in: 3002.8, 3003.4, 3004.1

• GHSA-cvcc-5x92-gmhc2022-03-30

  SaltStack Salt Improper Authentication via Man in the Middle Attack

  Fixed in: 3002.8, 3003.4, 3004.1

• GHSA-qcr3-hr2f-65572022-03-30

  SaltStack Salt Permissions Bypass

  Fixed in: 3002.8, 3003.4, 3004.1

• GHSA-pf7h-h2wq-m7pg2021-11-21

  Exposure of Resource to Wrong Sphere in salt

  Fixed in: 3003.3

• PYSEC-2013-132013-11-05

  Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. NOTE: the vendor states that this might not be a vulnerability because the YAML to be loaded has already been determined to be safe.

  Fixed in: 0.17.1