Skip to content
OpenAdvisories

Package · Alpine

salt

28 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.8
    CVE-2025-62348

    Salt junos module uses an unsafe YAML loader which may allow unintended code execution

    Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process.

    Salt Project Salt salt salt Ubuntu Alpine PyPI
  • High 7.7
    CVE-2024-22232

    Specially crafted url can be created which leads to a directory traversal in the salt file server

    A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem.

    VMware Salt Project salt salt Ubuntu Alpine PyPI
  • High 8.8
    CVE-2022-22936

    SaltStack Salt Authentication Bypass by Capture-replay

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server …

    salt salt salt Ubuntu Alpine PyPI
  • High 8.8
    CVE-2022-22934

    SaltStack Improper Verification of Cryptographic Signature

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.

    salt salt salt Ubuntu Alpine PyPI
  • High 8.8
    CVE-2022-22941

    SaltStack Salt Permissions Bypass

    An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectl…

    salt salt salt Ubuntu Alpine PyPI
  • High 7.5
    CVE-2021-21996

    Exposure of Resource to Wrong Sphere in salt

    An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.

    salt salt salt Ubuntu Alpine PyPI
  • High 7.8
    CVE-2021-31607

    Command Injection in SaltStack Salt

    In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that t…

    salt salt salt Ubuntu Alpine PyPI
  • High 8.8
    CVE-2017-5200

    SaltStack Salt arbitrary command execution in Salt-api via ssh_client

    Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.

    salt salt salt Ubuntu Alpine PyPI
  • High 8.8
    CVE-2017-5192

    SaltStack Salt Authentication Bypass when using the local_batch client from salt-api

    When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed.

    salt salt salt Ubuntu Alpine PyPI