GitHub Advisoryadvisory · PyPI

GHSA-jh7c-xh74-h76f Salt has minion event bus authorization bypass vulnerability

HIGH Published 2025-06-13 Modified 2025-06-13 Official page ↗

Aliases: CVE-2025-22236
Ecosystem: PyPI
Packages: salt
Severity: High
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Weaknesses: CWE-287
Reviewed: 2025-06-13

Affected packages

• PyPI salt: >= 3007.0, < 3007.4 → fixed in 3007.4 • PyPI salt: >= 3006.0, < 3006.12 → fixed in 3006.12

Description

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).

Alias · CVE (1)

CVE-2025-22236 Minion event bus authorization bypass. vulnerability

Weakness · CWE (1)

CWE-287 Improper Authentication weakness

References