CVE-2020-11651: SaltStack Salt Authentication Bypass Vulnerability
Vulnerability summary
CVE-2020-11651 is a critical (CVSS 9.8) vulnerability in SaltStack Salt. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 96.61% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 5 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 18 · Related 15Timeline
- 30-04-2020PublishedVulnerability first disclosed.
- 03-11-2021Added to CISA KEVSaltStack Salt Authentication Bypass Vulnerability
- 03-05-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · PypiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
96.61%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 96.61% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-11-2021
- Federal due date
- 03-05-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2020-11651
Public exploits
5 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Saltstack 3000.1 - Remote Code Execution
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04
Debian1 product
- debian_linuxEOL8.0 | 9.0 | 10.0
Opensuse1 product
- leapEOL15.1
PyPI1 product
- salt< 2019.2.4 | ≥ 3000, < 3000.2
Saltstack1 product
- salt< 2019.2.4 | ≥ 3000, < 3000.2
Ubuntu1 product
- salt< 0.17.5+ds-1ubuntu0.1~esm2 | < 2015.8.8+ds-1ubuntu0.1 | < 2017.7.4+dfsg1-1ubuntu18.04.2
Vmware1 product
- application_remote_collector7.5.0 | 8.0.0
7 vendors · 7 products
References
22 links- github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/3000.2.rstX Refsource MISCWEBREPORTThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.htmlVendor AdvisoryX Refsource SUSEWEBREPORTMailing ListThird Party Advisory
- packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.htmlX Refsource MISCWEBExploitThird Party AdvisoryVDB Entry
www.debian.org/security/2020/dsa-4676Vendor AdvisoryX Refsource DEBIANWEBAdvisoryThird Party Advisory- www.vmware.com/security/advisories/VMSA-2020-0009.htmlX Refsource CONFIRMWEBAdvisoryThird Party Advisory
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AGVendor AdvisoryX Refsource CISCOWEBThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/05/msg00027.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
Show all 22 references
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-11651Government ResourceUS Government Resource
- github.com/saltstack/saltPACKAGE