CVE-2025-62349 — Improper Authentication in Project Salt
Severity
7.5HIGHNVD
EPSS
0.0%
top 91.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 30
Description
Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected Packages2 packages
🔴Vulnerability Details
3OSV▶
CVE-2025-62349: Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features↗2026-01-30