CVE-2020-11651: SaltStack Salt Authentication Bypass Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 96.6% chance of exploitation in the next 30 days.

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.

Affected products

• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Opensuse Leap: version 15.1 only
• SaltStack Salt: before 2019.2.4 (fixed in 2019.2.4); from 3000, before 3000.2 (fixed in 3000.2)
• VMware Application Remote Collector: version 7.5.0 only; version 8.0.0 only

Published 2020-04-30. Last modified 2026-06-17.