Skip to content
OpenAdvisories
Critical 1 exploited CVE USN-7181-1 1 CVE

salt vulnerability

Published Jan 6, 2025 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Salt incorrectly handled web requests when the SSH
client was enabled. An attacker could possibly use this issue to achieve
remote code execution or obtain sensitive information.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS salt 0.17.5+ds-1ubuntu0.1~esm4

Vulnerabilities 1

  • Critical 9.8
    CVE-2020-16846 Exploited Public exploit Scanner template EPSS 100%

    SaltStack Salt Command Injection in netapi ssh client

    An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021

References

  • report
    https://ubuntu.com/security/CVE-2020-16846