End of life: 6/30/2028, End of support: 6/30/2027, Latest version: 3008.5
Due to a supply chain incident, Salt has rotated secrets and initiated the revocation of compromised macOS DeveloperID signing certificates.
Salt Project Community Members! The Salt Project is announcing the Salt 3006.17 LTS and 3007.9 STS CVE releases. This release addresses 2 CVEs, ranging from low to medium in severity. To download and install the latest versions of Salt, see the Salt install guide . For more details on the Salt 3006.17 LTS release: For more details on the Salt 3007.9 STS release: Directory repository locations: Thank you all for your contributions! – Salt Project Team
Directory traversal vulnerability in recvfile method allows arbitrary files to be written to the master cache directory.
Salt Project Community Members! The Salt Project is announcing the Salt 3006.12 LTS and 3007.4 STS CVE releases. This release addresses 11 CVEs, ranging from low to critical in severity. To download and install the latest versions of Salt, see the Salt install guide . For more details on the Salt 3006.12 LTS release: For more details on the Salt 3007.4 STS release: Directory repository locations: Thank you all for your contributions! – Salt Project Team
End of life: 6/30/2027, End of support: 7/31/2026, Latest version: 3006.30
End of life: 6/30/2027, End of support: 7/31/2026, Latest version: 3006.30
End of life: 7/31/2026, End of support: 6/30/2026, Latest version: 3007.17
End of life: 7/31/2026, End of support: 6/30/2026, Latest version: 3007.17
The Salt Project released a security update to Salt to address 2 vulnerabilities with severity rating of High and Medium. We recommend prioritizing this update. This is a security advisory release. This release includes fixing the following vulnerability:
A specially crafted url can be created which leads to a directory traversal in the salt file server.
Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master.
Dear Salt users and Salt Project community members, Some High and Medium rated vulnerabilities have been discovered in Salt versions 3006.5 and earlier. The vulnerabilities have a High and Medium rating based on the Common Vulnerability Scoring System (CVSS). We are preparing a CVE release that will be available on Wednesday, January 31. The CVE packages will be available for 3006.5 and 3005.4. The releases will contain the fix available to resolve and remediate the identified vulnerability. We advise all users to quickly apply the CVE release as soon as the packages are available. Please reach out if you have any questions or comments. You can reach us at saltproject-security.pdl@broadcom.com . Thank you, Your Salt Open Core team
The Salt Project released a security update to Salt to address 1 vulnerability with severity rating Medium. We recommend prioritizing this update. This is a security advisory release. This release includes fixing the following vulnerability:
The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script.
A Medium severity vulnerability has been discovered in Salt versions 3006.3 and earlier. The vulnerability is Medium severity based on the common Vulnerability Scoring System (CVSS).
The Salt Project released a security update to Salt to address 2 vulnerabilities with a severity rating of Medium. We strongly recommend prioritizing this update. This is a security advisory release.
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.
DOS in minion return.
Dear Salt users and Salt Project Community members, Some medium rated vulnerabilities have been discovered in Salt versions 3006.1 and earlier. The vulnerabilities are a Medium rating based on the Common Vulnerability Scoring System (CVSS). We are preparing a CVE release to be available on Thursday, August 10th. The CVE packages will be available for 3005.2 and 3006.2. The releases will contain the fixes available to resolve and remediate the identified vulnerabilities. We advise all users to quickly apply the CVE release as soon as the packages are available. Please reach out if you have any questions or comments. You can reach us at saltproject-security.pdl@broadcom.com . Thank you, Your Salt Open Core team
The Salt Project released a security update to Salt to address 1 vulnerability with severity rating High. If you are using PAM authentication from within Salt, we strongly recommend prioritizing this update. This is a security advisory release. This release includes fixes to the vulnerability and bug fixes from the previous CVE release. The following CVE was fixed as part of this release:
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
A critical vulnerability has been discovered in Salt versions 3004.1 and earlier. The vulnerability rating is high based on the Common Vulnerability Scoring System (CVSS).
The Salt Project released a security update to Salt to address 4 vulnerabilities with a severity rating of Medium to High. We strongly recommend prioritizing this update. This is a security advisory release. The following CVEs were fixed as part of this release:
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios.
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisheracl, if a user configured in the publisheracl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisheracl configured on the Master-of-Masters, allowing users specified in the publisheracl to bypass permissions, publishing authorized commands to any configured minion.
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
Dear Salt users and Salt Project Community members, Some critical vulnerabilities have been discovered in Salt versions 3004 and earlier. The vulnerabilities range in rating from Medium to High based on the Common Vulnerability Scoring System (CVSS). We are preparing a CVE release to be available on Monday, March 28th. The CVE packages will be available for 3002.8, 3003.4, and 3004.1. The releases will only contain the fixes available to resolve and remediate the identified vulnerabilities. We advise all users to quickly apply the CVE release as soon as the packages are available. Please reach out if you have any questions or comments. You can reach us at saltproject-security.pdl@broadcom.com . Thank you, Your Salt Open Core team
An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software.