Saltstack Salt vulnerabilities

CVE-2025-22241 [MEDIUM] CWE-22 Salt's file contents overwrite the VirtKey class Salt's file contents overwrite the VirtKey class File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.

CVE-2020-17490 [MEDIUM] CWE-732 CVE-2020-17490: The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.

CVE-2015-1838 [MEDIUM] CWE-19 CVE-2015-1838: modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

CVE-2015-1839 [MEDIUM] CWE-19 CVE-2015-1839: modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

CVE-2025-22242 [MEDIUM] CWE-770 Salt's worker process vulnerable to denial of service through file read operation Salt's worker process vulnerable to denial of service through file read operation Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by atte

CVE-2025-22238 [MEDIUM] CWE-22 Salt vulnerable to directory traversal attack in minion file cache creation Salt vulnerable to directory traversal attack in minion file cache creation Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.

CVE-2021-25284 [MEDIUM] CWE-522 CVE-2021-25284: An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credent An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.

CVE-2022-22935 [LOW] CWE-287 CVE-2022-22935: An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authen An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.

CVE-2015-8034 [LOW] CWE-200 CVE-2015-8034: The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file.