VYPR
← All advisories
High severityNVD Advisory· Published Sep 8, 2021· Updated Aug 3, 2024

CVE-2021-21996

CVE-2021-21996

Description

An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Allows root file system access on a Salt minion when source and source_hash URLs are controlled by an attacker.

Vulnerability

In Salt before version 3003.3, a user with control over the source and source_hash URLs can achieve full file system access as root on a salt minion. This vulnerability arises from insufficient validation of these URLs during the state file retrieval process, allowing an attacker to point a minion to arbitrary content [1] [3].

Exploitation

An attacker needs control over the source and source_hash URLs, typically achieved through compromising a Salt master or man-in-the-middle positioning. The attacker then serves a crafted payload, which the minion downloads and executes with root privileges [1].

Impact

Successful exploitation grants the attacker full file system access as root on the target Salt minion, enabling complete compromise of the minion's data and operations [1].

Mitigation

Upgrade Salt to version 3003.3 or later, which was released on September 8, 2021 [1]. For Debian-based systems, follow the instructions in the Debian LTS advisory [1]. Fedora packages were also updated [4]. No workaround is available for unpatched versions.

References
  1. NVD - CVE-2021-21996
  2. advisory-database/vulns/salt/PYSEC-2021-318.yaml at main · pypa/advisory-database
  3. Making sure you're not a bot!

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
saltPyPI
< 3003.33003.3

Affected products

73

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

18

News mentions

0

No linked articles in our index yet.