saltstack/salt · Security
Salt has minion event bus authorization bypass vulnerability
- GHSA ID
- GHSA-jh7c-xh74-h76f
- CVE ID
- CVE-2025-22236
- Severity
- high
- Published
- Updated
- CVSS
- 8.1 · CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
- CVSS v3
- 8.1 · CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Description
Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).
CWEs
- CWE-287 · Improper Authentication