VMware Salt vulnerabilities

10 CVEs affecting VMware Salt, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-22242, published 2025-06-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-22238, published 2025-06-13. Medium severity, CVSS 4.2. EPSS: 0.3% chance of exploitation in the next 30 days. Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files…
CVE-2024-38823, published 2025-06-13. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.
CVE-2024-38822, published 2025-06-13. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.
CVE-2025-22241, published 2025-06-13. Medium severity, CVSS 5.6. EPSS: 0.2% chance of exploitation in the next 30 days. File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to…
CVE-2025-22239, published 2025-06-13. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.
CVE-2025-22237, published 2025-06-13. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same…
CVE-2025-22236, published 2025-06-13. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).
CVE-2025-22240, published 2025-06-13. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be…
CVE-2024-38825, published 2025-06-13. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki…
CVE-2025-22242, published 2025-06-13. Medium severity, CVSS 5.6. EPSS: 0.1% chance of exploitation in the next 30 days. Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to…