salt project vulnerabilities

Products

• salt 3

Latest salt project CVEs

Newest publication first

1. CVE-2025-62349 Salt Master authentication protocol downgrade may enable minion impersonation

   Published 2026-01-30

   High·CVSS 7.5 EPSS 0.46%

   Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to p...

2. CVE-2025-62348 Salt junos module uses an unsafe YAML loader which may allow unintended code execution

   Published 2026-01-30

   High·CVSS 7.3 EPSS 0.20%

   Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process.

3. CVE-2023-34049 Salt security advisory release - 2023-OCT-27

   Published 2024-11-14

   Medium·CVSS 6.7 EPSS 0.21%

   The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH run...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.