Skip to content
Fencer Vulns
critical 9.8

CVE-2020-11651 kev in the critical feed json

SaltStack Salt Unauthenticated Remote Code Execution

published 2020-04-30 6 y ago modified 2026-06-17 4 mo ago also GHSA-pjhf-vpx3-33r3 , PYSEC-2020-102 , EUVD-2020-0171

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2021-11-03
epss
96.6%
EPSS 96.6% chance of exploitation in 30 days, percentile 99.8%
public exploits
3
Metasploit, Exploit-DB

Summary

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • pypi salt 2019.2.4, 3000.2
  • saltstack salt 2019.2.4, 3000.2
  • salt Ubuntu 16.04 LTS 2015.8.8+ds-1ubuntu0.1
  • salt Ubuntu 18.04 LTS 2017.7.4+dfsg1-1ubuntu18.04.2
  • salt Ubuntu Pro 14.04 LTS 0.17.5+ds-1ubuntu0.1~esm2

ubuntu advisories UBUNTU-CVE-2020-11651

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • salt SLES 15 SP1-BCL, SLE Module for Transactional Server 15 SP2, SLE Module for Server Applications 15 SP2 +10 more 3002.2-37.1
  • python-distro SLE Module for Python 2 15 SP3, SLE Module for Python 2 15 SP2, SLE Module for Basesystem 15 SP3 +2 more 1.5.0-3.5.1
  • salt SLE Module for Server Applications 15 SP1, SLE Module for Python 2 15 SP1, SLE Module for Basesystem 15 SP1 3000-6.37.1
  • salt SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 3000-5.78.1
  • salt SLE Point of Sale 12 SP2, SLE Module for Advanced Systems Management 12, Manager Server 3.2 +2 more 3000-46.101.1
  • python-singledispatch SLE Point of Sale 12 SP2, SLE Module for Advanced Systems Management 12, Manager Server 3.2 +2 more 3.4.0.3-1.5.1
  • salt Enterprise Storage 5 2016.11.4-48.10.1
  • salt SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 2019.2.0-5.67.1

suse advisories SUSE-SU-2021:2106-1SUSE-SU-2021:2105-1SUSE-SU-2020:1974-1SUSE-SU-2020:1973-1SUSE-SU-2020:1971-1SUSE-SU-2020:1392-1

  • python-distro openSUSE Leap 15.3 1.5.0-3.5.1
  • salt openSUSE Leap 15.2 3002.2-lp152.3.36.1
  • salt openSUSE Leap 15.1 3000-lp151.5.21.1
  • salt openSUSE Leap 15.1 2019.2.0-lp151.5.15.1

opensuse advisories openSUSE-SU-2021:2106-1openSUSE-SU-2021:0899-1openSUSE-SU-2020:1074-1openSUSE-SU-2020:0564-1

  • salt Alpine 3.11, Alpine 3.10 2019.2.4-r0
  • salt Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 3000.2-r0

alpine advisories ALPINE-CVE-2020-11651

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-11651 updated cvss 9.8

salt: salt-master process ClearFuncs class does not properly validate method calls

  • Red Hat Ceph Storage 2 salt, salt-minion
    affected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit auxiliary/gather/saltstack_salt_root_key)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
5 y ago
Patch by
2022-05-03 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
SaltStack, Salt
CISA name
SaltStack Salt Authentication Bypass Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction

96.61% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi salt
<2019.2.4
>=3000, <3000.2
2019.2.4
3000.2

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.