Skip to content

Saltstack · no weakness in the record

No weakness recorded

7 CVEs · 1 exploited

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

exploited in the wild
1

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

  1. An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a r…CVE-2020-11651SaltStack · CVSS 9.8 · 97% likely
  2. An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.CVE-2021-21996Saltstack · 3.4% likely
  3. Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.CVE-2017-5200Saltstack · 3.3% likely
  4. Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."CVE-2013-4437Saltstack · 1.5% likely
  5. In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master.CVE-2017-7893Saltstack · 1.4% likely
  6. An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attacke…CVE-2022-22934Saltstack · 0.9% likely
  7. Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers w…CVE-2023-20898Saltstack · CVSS 4.2 · 0.3% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.