CVE-2021-33226: SaltStack Salt

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input

Affected products

• SaltStack Salt: up to and including 3003

Published 2023-02-17. Last modified 2026-06-17.