VYPR
← All advisories
High severityNVD Advisory· Published Mar 29, 2022· Updated May 5, 2025

CVE-2022-22936

CVE-2022-22936

Description

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

SaltStack Salt before versions 3002.8, 3003.4, and 3004.1 is vulnerable to replay attacks on job publishes and file server replies, potentially allowing an attacker to gain root access on minions.

Vulnerability

A replay vulnerability exists in SaltStack Salt in versions prior to 3002.8, 3003.4, and 3004.1. Job publishes and file server replies are susceptible to replay attacks, where an attacker can capture and retransmit legitimate requests to trigger unintended actions. The code path is reachable without special configuration, as it affects the default communication between Salt master and minions.

Exploitation

An attacker needs network access to capture Salt traffic between the master and minions. The attacker can replay captured job publishes to cause minions to execute old jobs, or replay file server replies to potentially alter the files received by minions. The attack requires no authentication or user interaction, as the master and minions trust the source of the message based on the message content alone.

Impact

Successful exploitation allows an attacker to force minions to run arbitrary (old) jobs or serve malicious files. Under certain scenarios, a sufficiently craft attacker could escalate this to gain root access on the minion, leading to full compromise of the minion system.

Mitigation

Fixed versions are 3002.8, 3003.4, and 3004.1, released on or around March 29, 2022 [1][2]. Users should upgrade to these or later versions. No workarounds have been publicly disclosed as noted in the advisory database. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

References
  1. NVD - CVE-2022-22936
  2. Releases · saltstack/salt

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
saltPyPI
< 3002.83002.8
saltPyPI
>= 3003, < 3003.43003.4
saltPyPI
>= 3004, < 3004.13004.1

Affected products

35

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.