Salt
by Saltstack
Source repositories
CVEs (66)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-34049 | Med | 0.37 | 6.7 | 0.00 | Nov 14, 2024 | The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH… | ||
| CVE-2020-17490 | Med | 0.36 | 5.5 | 0.00 | Nov 6, 2020 | The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. | ||
| CVE-2016-3176 | Med | 0.36 | 5.6 | 0.01 | Jan 31, 2017 | Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient. | ||
| CVE-2024-38825 | Med | 0.35 | 6.4 | 0.00 | Jun 13, 2025 | The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for… | ||
| CVE-2023-20897 | Med | 0.35 | 5.3 | 0.01 | Sep 5, 2023 | Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted. | ||
| CVE-2025-22240 | Med | 0.34 | 6.3 | 0.00 | Jun 13, 2025 | Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has… | ||
| CVE-2025-22242 | Med | 0.29 | 5.6 | 0.00 | Jun 13, 2025 | Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could… | ||
| CVE-2025-22241 | Med | 0.29 | 5.6 | 0.00 | Jun 13, 2025 | File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization… | ||
| CVE-2021-25284 | Med | 0.29 | 4.4 | 0.01 | Feb 27, 2021 | An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. | ||
| CVE-2018-15750 | Med | 0.28 | 5.3 | 0.04 | Oct 24, 2018 | Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server. | ||
| CVE-2023-20898 | Med | 0.27 | 4.2 | 0.00 | Sep 5, 2023 | Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data… | ||
| CVE-2015-1839 | Med | 0.27 | 5.3 | 0.00 | Apr 13, 2017 | modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. | ||
| CVE-2015-1838 | Med | 0.27 | 5.3 | 0.00 | Apr 13, 2017 | modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. | ||
| CVE-2024-22231 | Med | 0.26 | 5.0 | 0.01 | Jun 27, 2024 | Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master. | ||
| CVE-2022-22935 | Low | 0.24 | 3.7 | 0.02 | Mar 29, 2022 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master. | ||
| CVE-2015-8034 | Low | 0.21 | 3.3 | 0.00 | Jan 30, 2017 | The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file. | ||
| CVE-2025-22238 | Med | 0.20 | 4.2 | 0.00 | Jun 13, 2025 | Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory. | ||
| CVE-2024-38823 | Low | 0.18 | 2.7 | 0.00 | Jun 13, 2025 | Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport. | ||
| CVE-2024-38822 | Low | 0.18 | 2.7 | 0.00 | Jun 13, 2025 | Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion. | ||
| CVE-2014-3563 | 0.00 | — | 0.00 | Aug 22, 2014 | Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud. |
- risk 0.37cvss 6.7epss 0.00
The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH…
- risk 0.36cvss 5.5epss 0.00
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
- risk 0.36cvss 5.6epss 0.01
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
- risk 0.35cvss 6.4epss 0.00
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for…
- risk 0.35cvss 5.3epss 0.01
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.
- risk 0.34cvss 6.3epss 0.00
Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has…
- risk 0.29cvss 5.6epss 0.00
Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could…
- risk 0.29cvss 5.6epss 0.00
File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization…
- risk 0.29cvss 4.4epss 0.01
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
- risk 0.28cvss 5.3epss 0.04
Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.
- risk 0.27cvss 4.2epss 0.00
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data…
- risk 0.27cvss 5.3epss 0.00
modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
- risk 0.27cvss 5.3epss 0.00
modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
- risk 0.26cvss 5.0epss 0.01
Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master.
- risk 0.24cvss 3.7epss 0.02
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.
- risk 0.21cvss 3.3epss 0.00
The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.
- risk 0.20cvss 4.2epss 0.00
Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.
- risk 0.18cvss 2.7epss 0.00
Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.
- risk 0.18cvss 2.7epss 0.00
Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.
- CVE-2014-3563Aug 22, 2014risk 0.00cvss —epss 0.00
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
Page 3 of 4