Salt
Vendor:
First CVE: Nov 5, 2013 · Active for 12 years
55
Total CVEs
More Total CVEs than 98% of tracked products
4.6
Avg CVEs / Year
Higher CVE frequency than 87% of tracked products
7.8
Avg CVSS
Higher Avg CVSS than 67% of tracked products
5.5%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Salt over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 5, 2013
12 years ago
Most Recent CVE
Jan 30, 2026
175 days ago
CVE Severity & Scoring
Salt55 CVEs
25%
42%
29%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local13 (23.6%)
Network33 (60.0%)
Unknown7 (12.7%)
Physical0 (0.0%)
Adjacent Network2 (3.6%)
Attack Complexity
Low38 (69.1%)
High10 (18.2%)
Unknown7 (12.7%)
User Interaction
None47 (85.5%)
Unknown7 (12.7%)
Required1 (1.8%)
Privileges Required
Low17 (30.9%)
High3 (5.5%)
None28 (50.9%)
Unknown7 (12.7%)
Top CVEs
Signals from CVEs in this product scope (55 CVEs).
55 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-16846CRITICAL An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. | Nov 6, 2020 | 9.8 | 98 | YES | YES |
CVE-2020-11651CRITICAL An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a re | Apr 30, 2020 | 9.8 | 98 | YES | YES |
CVE-2020-11652MEDIUM An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize pa | Apr 30, 2020 | 6.5 | 96 | YES | YES |
CVE-2021-25282CRITICAL An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. | Feb 27, 2021 | 9.1 | 86 | NO | YES |
CVE-2021-25281CRITICAL An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel | Feb 27, 2021 | 9.8 | 86 | NO | YES |
CVE-2020-25592CRITICAL In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. | Nov 6, 2020 | 9.8 | 73 | NO | YES |
CVE-2021-3197CRITICAL An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options p | Feb 27, 2021 | 9.8 | 71 | NO | NO |
CVE-2019-17361CRITICAL In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access | Jan 17, 2020 | 9.8 | 39 | NO | NO |
CVE-2021-25283CRITICAL An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. | Feb 27, 2021 | 9.8 | 35 | NO | NO |
CVE-2021-3148CRITICAL An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of differen | Feb 27, 2021 | 9.8 | 34 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (55 CVEs).
CISA KEV
3 CVEs
5.5% of CVEs· 97th percentile
Metasploit
6 CVEs
10.9% of CVEs· 97th percentile
Nuclei
2 CVEs
3.6% of CVEs· 97th percentile
ExploitDB
2 CVEs
3.6% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (55 CVEs).
Media Mentions
Signals from CVEs in this product scope (55 CVEs).
Top CNAs Publishing CVEs For Salt
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3002 | 1 | 9.8 | 99.6% | 1 | 1 |
| 3001 | 3 | 8.4 | 52.5% | 1 | 2 |
| 2017.7.1 | 2 | 8.7 | 2.6% | 0 | 0 |
| 2017.7.0 | 3 | 8.9 | 3.0% | 0 | 0 |
| 2016.3.4 | 2 | 8.8 | 2.4% | 0 | 0 |
| 2016.3.3 | 2 | 8.8 | 2.4% | 0 | 0 |
| 2016.3.2 | 2 | 8.8 | 2.4% | 0 | 0 |
| 2016.3.1 | 2 | 8.8 | 2.4% | 0 | 0 |
| 2016.3.0 | 2 | 8.8 | 2.4% | 0 | 0 |
| 2016.11.7 | 2 | 8.7 | 2.6% | 0 | 0 |
| 2016.11.6 | 2 | 8.7 | 2.6% | 0 | 0 |
| 2016.11.5 | 2 | 8.7 | 2.6% | 0 | 0 |
| 2016.11.4 | 2 | 8.7 | 2.6% | 0 | 0 |
| 2016.11.3 | 3 | 8.4 | 1.9% | 0 | 0 |
| 2016.11.2 | 5 | 8.5 | 2.1% | 0 | 0 |
| 2016.11.1 | 5 | 8.6 | 2.4% | 0 | 0 |
| 2016.11.0 | 5 | 8.3 | 1.6% | 0 | 0 |
| 2016.11 | 3 | 8.4 | 1.9% | 0 | 0 |
| 2015.8.7 | 1 | 5.6 | 0.9% | 0 | 0 |
| 2015.8.5 | 1 | 5.6 | 0.9% | 0 | 0 |