SaltStack In October 2020, VMware acquired SaltStack. SaltStack helps customers to automate ITOps, DevOps, NetOps or SecOps functions.

Known Exploited SaltStack Vulnerabilities

The following SaltStack vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 3 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 0 vulnerabilities in SaltStack. Last year, in 2025 SaltStack had 7 security vulnerabilities published. Right now, SaltStack is on track to have less security vulnerabilities in 2026 than it did last year.

Recent SaltStack Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2024-38824	Jun 13, 2025	Directory Traversal via recv_file Enables Arbitrary File Write to Master Cache Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.	Salt
CVE-2024-38823	Jun 13, 2025	SaltStack Salt Request Server Replay Attack (No TLS) Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.	Salt
CVE-2025-22236	Jun 13, 2025	Salt Minion v>=3007.0 Event Bus Auth Bypass Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).	Salt
CVE-2024-38822	Jun 13, 2025	Salt Master Token Validation Bypass Enables Minion Impersonation Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.	Salt
CVE-2025-22240	Jun 13, 2025	SaltStack GitFS arbitrary file deletion via unvalidated tgt_env path Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the tgt_env variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to.	Salt
CVE-2024-38825	Jun 13, 2025	SaltStack: pki Auth Allows Authentication Without Private Key The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.	Salt
CVE-2025-22242	Jun 13, 2025	SaltStack Salt Master pub_ret Untrusted File Read DoS Worker process denial of service through file read operation. .A vulnerability exists in the Master's pub_ret method which is exposed to all minions. The un-sanitized input value jid is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.	Salt
CVE-2024-22232	Jun 27, 2024	Directory Traversal in Salt File Server Enables Arbitrary File Read A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt masters filesystem.	Salt
CVE-2024-22231	Jun 27, 2024	Syndic cache dir traversal leads to arbitrary directory creation on Salt Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master.	Salt
CVE-2023-20897	Sep 05, 2023	SaltStack Salt 3005.2/3006.2 DoS via Minion Return Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.	Salt