saltproject-2026-04-29-advisory: Supply Chain Incident - 2026-Apr-29
Due to a supply chain incident, Salt has rotated secrets and initiated the revocation of compromised macOS DeveloperID signing certificates.
Other sources
We are issuing this notification regarding actions affecting our macOS signing certificates. On or about March 31, 2026, the saltstack/salt repository was affected by the downstream publication of malicious versions of the axios npm package (1.14.1 and 0.30.4). Out of an abundance of caution, we have taken the following actions with regard to our macOS DeveloperID Installer Signing Certificate and DeveloperID Application Signing Certificate: Our current priority is to release a new, securely signed version as quickly as possible. The timeline for revoking the exposed certificates is contingent on this new release: We urge all macOS users to install the new release (version: 3006.24 and 3007.14), signed with the new certificates, as soon as it becomes available on April 23rd, 2026. This will ensure continuity of service and provide the highest level of security. We appreciate your immediate attention to this matter and thank you for your patience and cooperation as we work diligently to resolve this incident. – Salt Project Team
— Salt Project
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Saltto a version that resolves this vulnerability.Fixed in 3006.24 - Upgrade
Upgrade
Saltto a version that resolves this vulnerability.Fixed in 3007.14
Event History
Frequently Asked Questions
What is the severity of saltproject-2026-04-29-advisory?
The severity of saltproject-2026-04-29-advisory is high due to the potential impact on the integrity of software distribution.
How do I fix saltproject-2026-04-29-advisory?
To fix saltproject-2026-04-29-advisory, ensure that you update to a patched version of Salt and replace any affected certificates.
What software is affected by saltproject-2026-04-29-advisory?
Salt Project Salt is the software affected by saltproject-2026-04-29-advisory.
What actions were taken in response to saltproject-2026-04-29-advisory?
In response to saltproject-2026-04-29-advisory, Salt has rotated secrets and revoked compromised macOS DeveloperID signing certificates.
What should I do if I am using an affected version of Salt related to saltproject-2026-04-29-advisory?
If you are using an affected version of Salt related to saltproject-2026-04-29-advisory, you should immediately follow the guidelines provided in the advisory to mitigate risks.