VYPR
← All advisories
High severityNVD Advisory· Published Mar 29, 2022· Updated May 5, 2025

CVE-2022-22941

CVE-2022-22941

Description

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

SaltStack Salt before 3002.8, 3003.4, 3004.1 allows publisher_acl users to bypass permissions when using Syndic master, targeting any minion.

Vulnerability

An issue in SaltStack Salt before versions 3002.8, 3003.4, and 3004.1 affects deployments configured as a Master-of-Masters with a publisher_acl. When a user specified in the publisher_acl targets a minion connected to a Syndic, the Salt Master incorrectly interprets the absence of valid targets as a valid target set, allowing the user's authorized commands to be sent to any minion connected to the Syndic [1].

Exploitation

This vulnerability requires a Syndic master combined with publisher_acl configured on the Master-of-Masters. An attacker must be a user listed in the publisher_acl. The attacker targets any minion connected to the Syndic; the master then treats the empty target list as valid, publishing the command to all Syndic-connected minions [1]. No additional authentication or user interaction beyond the ACL is needed.

Impact

A successful exploitation allows the attacker to bypass the permissions enforced by publisher_acl, enabling them to execute their configured commands on any minion attached to the Syndic. This can lead to unauthorized command execution, privilege escalation, and compromise of minion systems [1][4].

Mitigation

The issue is fixed in Salt versions 3002.8, 3003.4, and 3004.1. Users should upgrade their Salt masters to these versions. No workaround is documented in the available references. The fix is tracked in GitHub issue #60413 and mentioned in the release notes [4].

References
  1. NVD - CVE-2022-22941
  2. salt/doc/topics/releases/3004.1.rst at 8f9405cf8e6f7d7776d5000841c886dec6d96250 · saltstack/salt

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
saltPyPI
< 3002.83002.8
saltPyPI
>= 3003, < 3003.43003.4
saltPyPI
>= 3004, < 3004.13004.1

Affected products

35

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.