Read the docs
TI-2022-07119 Aliases CVE-2022-22941GHSA-qcr3-hr2f-6557

Incorrect permission assignment in SaltStack Salt

Priority MEDIUM 43CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01335 71st percentileScored 2026-11-07
Fix Fixed salt (PyPI): 3002.8, 3003.4, 3004.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—SaltStack SaltSaltStack Salt prior to 3002.8, 3003.4, 3004.1—No fix listedCNA
—salt (PyPI)before 3002.83002.8Patch availableGHSA-qcr3-hr2f-6557
—salt (PyPI)3003 to before 3003.43003.4Patch availableGHSA-qcr3-hr2f-6557
—salt (PyPI)3004 to before 3004.13004.1Patch availableGHSA-qcr3-hr2f-6557
  • SaltStack Salt Vendor— Affected SaltStack Salt prior to 3002.8, 3003.4, 3004.1 Fixed in — No fix listed CNA
  • salt (PyPI) Vendor— Affected before 3002.8 Fixed in 3002.8 Patch available GHSA-qcr3-hr2f-6557
  • salt (PyPI) Vendor— Affected 3003 to before 3003.4 Fixed in 3003.4 Patch available GHSA-qcr3-hr2f-6557
  • salt (PyPI) Vendor— Affected 3004 to before 3004.1 Fixed in 3004.1 Patch available GHSA-qcr3-hr2f-6557

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:*3002 to before 3002.8; 3003 to before 3003.4; 3004 to before 3004.1VulnerableSaltStack
  • cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* Versions 3002 to before 3002.8; 3003 to before 3003.4; 3004 to before 3004.1 Vulnerable ·SaltStack

Remediation

  • Fix · GHSA-qcr3-hr2f-6557 salt (PyPI) Fixed in 3002.8 Advisory →
  • Fix · GHSA-qcr3-hr2f-6557 salt (PyPI) Fixed in 3003.4 Advisory →
  • Fix · GHSA-qcr3-hr2f-6557 salt (PyPI) Fixed in 3004.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22941
  2. 2026-10-03 Alias added: GHSA-qcr3-hr2f-6557

References

Advisory 2

Other 9

  • TI-2020-12851 An issue was discovered in SaltStack Salt through 3002. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-07530 An issue was discovered in through SaltStack Salt before 3002.5. CVSS 3.1CRITICAL 9.8
  • TI-2020-09350 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1MEDIUM 6.5
  • TI-2021-07531 An issue was discovered in through SaltStack Salt before 3002.5. CVSS 3.1CRITICAL 9.1
  • TI-2021-12769 Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute… CVSS 3.1CRITICAL 9.8
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences