An issue was discovered in SaltStack Salt through 3002.

Summary

SaltStack Salt, a configuration management and remote execution platform, is affected by this vulnerability. An attacker who sends specially crafted web requests to its API can inject shell commands when the SSH client is enabled, potentially allowing them to run arbitrary commands on the system.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Nov 6, 2020, 7:27 AM UTCCVE published
2. Nov 3, 2021Added to CISA KEV

   CISA has evidence of exploitation in the wild

3. May 3, 2022CISA remediation deadline

   Due date for US federal agencies to patch

4. Oct 21, 2025, 11:35 PM UTCRecord last updated
5. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• saltPyPI

  fixed in 2015.8.13

• saltPyPI

  From 2016.3.0 · fixed in 2016.3.8

• saltPyPI

  From 2016.11.0 · fixed in 2016.11.10

• saltPyPI

  From 2017.5.0 · fixed in 2017.7.8

• saltPyPI

  From 2018.2.0 · fixed in 2018.3.5

• saltPyPI

  From 2019.2.0 · fixed in 2019.2.6

• saltPyPI

  From 3000.0 · fixed in 3000.4

• saltPyPI

  From 3001 · fixed in 3001.2

• saltPyPI

  From 3002 · fixed in 3002.1

• saltPyPI

  fixed in 2015.8.10; From 2015.8.11 · fixed in 2015.8.13; From 2016.3.0 · fixed in 2016.3.4; From 2016.3.5 · fixed in 2016.3.6; From 2016.3.7 · fixed in 2016.3.8; From 2016.11.0 · fixed in 2016.11.3; From 2016.11.4 · fixed in 2016.11.6; From 2016.11.7 · fixed in 2016.11.10; From 2017.7.0 · fixed in 2017.7.4; From 2017.7.5 · fixed in 2017.7.8; From 2018.3.0rc1 · fixed in 2018.3.5; From 2019.2.0 · fixed in 2019.2.5; From 3000 · fixed in 3000.3

References 14