VYPR
← All advisories
Critical severityNVD Advisory· Published Feb 27, 2021· Updated Nov 19, 2024

CVE-2021-25281

CVE-2021-25281

Description

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

SaltStack Salt before 3002.5 allows unauthenticated remote execution of wheel modules via salt-api's wheel_async endpoint due to improper eauth credential validation.

Vulnerability

Overview

The vulnerability (CVE-2021-25281) is an authentication bypass in SaltStack's REST API (salt-api). The wheel_async client endpoint fails to properly validate eauth credentials, meaning an attacker can invoke wheel modules without any authentication [1]. The root cause is a missing credential check in the API's handling of asynchronous wheel requests.

Exploitation

Exploitation requires network access to the salt-api process, which typically listens on port 8000. No prior authentication or session is needed. An attacker simply crafts a request to the wheel_async method with the desired wheel module and arguments [1]. Public proof-of-concept code exists demonstrating the exploitation [1].

Impact

Successful exploitation allows an attacker to execute arbitrary wheel modules on the Salt master. This includes modules for managing minions, configuration, and secrets, effectively granting full control over the master and all connected minions. The attacker can execute commands, exfiltrate data, and pivot further into the infrastructure.

Mitigation

The issue was fixed in Salt version 3002.5, released on February 26, 2021 [2]. Users still running older versions should upgrade immediately. The PyPA advisory database also confirms the severity and remediation [4].

Note: Salt versions 3002.5 and later include the patch; there is no workaround for unpatched installations.

References
  1. NVD - CVE-2021-25281
  2. Releases · saltstack/salt
  3. advisory-database/vulns/salt/PYSEC-2021-50.yaml at main · pypa/advisory-database

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
saltPyPI
< 2015.8.132015.8.13
saltPyPI
>= 2016.3.0, < 2016.11.52016.11.5
saltPyPI
>= 2016.11.7, < 2016.11.102016.11.10
saltPyPI
>= 2017.5.0, < 2017.7.82017.7.8
saltPyPI
>= 2018.2.0, <= 2018.3.5—
saltPyPI
>= 2019.2.0, < 2019.2.82019.2.8
saltPyPI
>= 3000, < 3000.73000.7
saltPyPI
>= 3001, < 3001.53001.5
saltPyPI
>= 3002, < 3002.33002.3

Affected products

32

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

24

News mentions

0

No linked articles in our index yet.