CVE-2025-62349 | Medium | 6.2 | — | 2026-01-30 | Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventin… |
CVE-2025-62348 | High | 7.8 | — | 2026-01-30 | Salt's junos execution module contained an unsafe YAML decode/load usage. |
CVE-2024-38824 | Critical | 9.6 | — | 2025-06-13 | Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory. |
CVE-2025-22242 | Medium | 5.6 | — | 2025-06-13 | Worker process denial of service through file read operation. |
CVE-2025-22241 | Medium | 5.6 | — | 2025-06-13 | File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. |
CVE-2025-22240 | Medium | 6.3 | — | 2025-06-13 | Arbitrary directory creation or file deletion. |
CVE-2025-22239 | High | 8.1 | — | 2025-06-13 | Arbitrary event injection on Salt Master. |
CVE-2025-22238 | Medium | 4.2 | — | 2025-06-13 | Directory traversal attack in minion file cache creation. |
CVE-2025-22237 | Medium | 6.7 | — | 2025-06-13 | An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process. |
CVE-2025-22236 | High | 8.1 | — | 2025-06-13 | Minion event bus authorization bypass. |
CVE-2024-38825 | Medium | 6.4 | — | 2025-06-13 | The salt.auth.pki module does not properly authenticate callers. |
CVE-2024-38823 | Low | 2.7 | — | 2025-06-13 | Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport. |
CVE-2024-38822 | Low | 2.7 | — | 2025-06-13 | Multiple methods in the salt master skip minion token validation. |
CVE-2023-34049 | Medium | 6.7 | — | 2024-11-14 | The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. |
CVE-2023-20898 | Medium | 4.2 | — | 2023-09-05 | Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. |
CVE-2023-20897 | Medium | 5.3 | — | 2023-09-05 | Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. |
CVE-2021-33226 | Critical | 9.8 | — | 2023-02-17 | Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. |
CVE-2022-22967 | High | 8.8 | — | 2022-06-23 | An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. |
CVE-2022-22941 | High | 8.8 | — | 2022-03-29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. |
CVE-2022-22936 | High | 8.8 | — | 2022-03-29 | An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. |