Description
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VMware | SALT | 3006.x – < 3006.12, 3007.x – < 3007.4 | 3006.12 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | salt | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | salt | No fix yet | — |
| Ubuntu Pro 16.04 LTS | salt | No fix yet | — |
| Ubuntu Pro 14.04 LTS | salt | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | salt | 3006.0-150700.14.5.2 | SUSE-SU-2025:02502-1 |
| SLES 15 SP6 | salt | 3006.0-150500.4.55.1 | SUSE-SU-2025:02501-1 |
| SLES 15 SP5 | salt | 3006.0-150500.4.55.1 | SUSE-SU-2025:02501-1 |
| SLES 15 SP4 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SLES 15 SP3 | salt | 3006.0-150300.53.94.1 | SUSE-SU-2025:02534-1 |
Show 23 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | salt | 3006.0-150500.4.55.1 | SUSE-SU-2025:02501-1 |
| SLES for SAP 15 SP4 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SLES for SAP 15 SP3 | salt | 3006.0-150300.53.94.1 | SUSE-SU-2025:02534-1 |
| SLE Micro 6.1 | salt | 3006.0-slfo.1.1_4.1 | SUSE-SU-2025:20487-1 |
| SLE Micro 6.0 | salt | 3006.0-13.1 | SUSE-SU-2025:20504-1 |
| SLE Micro 5.5 | salt | 3006.0-150500.4.55.1 | SUSE-SU-2025:02501-1 |
| SLE Micro 5.4 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SLE Micro 5.3 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SLE Micro 5.2 | salt | 3006.0-150300.53.94.1 | SUSE-SU-2025:02534-1 |
| SLE Micro 5.1 | salt | 3006.0-150300.53.94.1 | SUSE-SU-2025:02534-1 |
| SLE HPC 15 SP5 | salt | 3006.0-150500.4.55.1 | SUSE-SU-2025:02501-1 |
| SLE HPC 15 SP4 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SLE HPC 15 SP3 | salt | 3006.0-150300.53.94.1 | SUSE-SU-2025:02534-1 |
| SUSE Manager Server Module 4.3 | venv-salt-minion | 3006.0-150000.3.78.1 | SUSE-SU-2025:02492-1 |
| SUSE Manager Server 4.3 | release-notes-susemanager | 4.3.16-150400.3.140.1 | SUSE-SU-2025:02476-1 |
| SUSE Manager Server 4.3 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SUSE Manager Proxy Module 4.3 | venv-salt-minion | 3006.0-150000.3.78.1 | SUSE-SU-2025:02492-1 |
| SUSE Manager Proxy 4.3 | release-notes-susemanager-proxy | 4.3.16-150400.3.98.1 | SUSE-SU-2025:02476-1 |
| SUSE Manager Proxy 4.3 | salt | 3006.0-150400.8.80.1 | SUSE-SU-2025:02500-1 |
| SUSE Manager Client Tools for SLE Micro 5 | venv-salt-minion | 3006.0-150000.3.78.1 | SUSE-SU-2025:02492-1 |
| SUSE Manager Client Tools for RHEL, Liberty and Clones 9 | venv-salt-minion | 3006.0-1.59.1 | SUSE-SU-2025:02499-1, SUSE-EL-9-CLIENT-TOOLS-2025-2499 |
| SUSE Manager Client Tools 15 | venv-salt-minion | 3006.0-150000.3.78.1 | SUSE-SU-2025:02492-1 |
| SUSE Manager Client Tools 12 | venv-salt-minion | 3006.0-3.76.2 | SUSE-SU-2025:02491-1 |
| SUSE Enterprise Storage 7.1 | salt | 3006.0-150300.53.94.1 | SUSE-SU-2025:02534-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy +1 | 3.11.11-1.32.1 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-cython | 0.29.37-1.12.2 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-jinja2 | 3.1.2-1.12.2 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-lxml | 4.9.4-1.21.1 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-m2crypto | 0.45.1-1.12.1 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-msgpack | 1.0.7-1.14.1 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-ply | 3.11-1.8.1 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-tornado | 6.3.2-1.12.2 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | saltbundlepy-zypp-plugin | 0.6.5-1.11.1 | SUSE-SU-2025:02499-1 |
| SUSE EL-9:Update:Products:SaltBundle:Update | venv-salt-minion | 3006.0-1.59.1 | SUSE-SU-2025:02499-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | salt | 3006.0-41.1 | openSUSE-SU-2025:15295-1 |
| openSUSE Leap 15.6 | salt +1 | 3006.0-150500.4.55.1 | SUSE-SU-2025:02501-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | salt | >= 3006.0rc1, < 3006.12 | 3006.12 | GHSA-4j59-vv55-q6h3 |
| PyPI | salt | >= 3007.0rc1, < 3007.4 | 3007.4 | GHSA-4j59-vv55-q6h3 |
| PyPI | salt | >= 3006.0rc1, < 3006.12 · >= 3007.0rc1, < 3007.4 | 3006.12, 3007.4 | PYSEC-2026-1893 |
Advisories 13
- SUSE-EL-9-CLIENT-TOOLS-2025-2499 Security update 5.0.5 for Multi-Linux Manager Salt Bundle SUSE / openSUSE Security Updates · Jul 24, 2026
- WID-SEC-2025-1321 SaltStack Salt: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 12, 2026
- openSUSE-SU-2025:15295-1 python311-salt-3006.0-41.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20504-1 Security update 5.0.5 for Multi-Linux Manager Client Tools, Salt and Salt Bundle SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02501-1 Security update for salt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02500-1 Security update for salt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02491-1 Security update 5.0.5 for Multi-Linux Manager Salt Bundle SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20487-1 Security update for salt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02499-1 Security update 5.0.5 for Multi-Linux Manager Salt Bundle SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02492-1 Security update 5.0.5 for Multi-Linux Manager Salt Bundle SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02534-1 Security update for salt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02502-1 Security update for salt SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02476-1 Security update 4.3.16 for Multi-Linux Manager Server SUSE / openSUSE Security Updates · Mar 23, 2026