GitHub Advisoryadvisory · PyPI

GHSA-vcf3-26xf-fw4m Salt Authentication Protocol Version Downgrade Allows Minion Impersonation

HIGH Published 2026-01-30 Modified 2026-02-01 Official page ↗
Aliases
CVE-2025-62349
Ecosystem
PyPI
Packages
salt
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
Weaknesses
CWE-287
Reviewed
2026-02-01

Affected packages

• PyPI salt: >= 3006.12, < 3006.17 → fixed in 3006.17 • PyPI salt: >= 3007.4, < 3007.9 → fixed in 3007.9

Description

Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.

Related

Alias · CVE (1)

  • CVE-2025-62349 Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References