CVEvulnerability

CVE-2020-16846

9.8 CRITICAL Known exploited Published 2020-11-06 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

SaltStack Salt Shell Injection Vulnerability — SaltStack Salt

SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.

Added to KEV
2021-11-03
Remediation due
2022-05-03
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2020-16846
Status
Analyzed
Published
2020-11-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-78

Description

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

Affected configurations

• saltstack salt (< 2015.8.10) • saltstack salt (>= 2015.8.11 < 2015.8.13) • saltstack salt (>= 2016.3.0 < 2016.3.4) • saltstack salt (>= 2016.3.5 < 2016.3.6) • saltstack salt (>= 2016.3.7 < 2016.3.8) • saltstack salt (>= 2016.11.0 < 2016.11.3) • saltstack salt (>= 2016.11.4 < 2016.11.6) • saltstack salt (>= 2016.11.7 < 2016.11.10) • saltstack salt (>= 2017.5.0 < 2017.7.4) • saltstack salt (>= 2017.7.5 < 2017.7.8) • saltstack salt (>= 2018.2.0 < 2018.3.5) • saltstack salt (>= 2019.2.0 < 2019.2.5) • saltstack salt (>= 3000.0 < 3000.3) • saltstack salt 3001 • saltstack salt 3002 • debian debian linux 9.0 • debian debian linux 10.0 • fedoraproject fedora 31 • opensuse leap 15.1

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References