Read the docs
TI-2025-38622 Aliases CVE-2025-62349GHSA-vcf3-26xf-fw4m

Salt Master authentication protocol downgrade may enable minion impersonation

Priority LOW 35CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00456 39th percentileScored 2026-11-07
Fix Fixed Salt (Salt Project): 3006.17, 3007.9salt (PyPI): 3006.17, 3007.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Salt ProjectSalt3006.12 to before 3006.173006.17Patch availableCNA
Salt ProjectSalt3007.4 to before 3007.93007.9Patch availableCNA
—salt (PyPI)3006.12 to before 3006.173006.17Patch availableGHSA-vcf3-26xf-fw4m
—salt (PyPI)3007.4 to before 3007.93007.9Patch availableGHSA-vcf3-26xf-fw4m
  • Salt VendorSalt Project Affected 3006.12 to before 3006.17 Fixed in 3006.17 Patch available CNA
  • Salt VendorSalt Project Affected 3007.4 to before 3007.9 Fixed in 3007.9 Patch available CNA
  • salt (PyPI) Vendor— Affected 3006.12 to before 3006.17 Fixed in 3006.17 Patch available GHSA-vcf3-26xf-fw4m
  • salt (PyPI) Vendor— Affected 3007.4 to before 3007.9 Fixed in 3007.9 Patch available GHSA-vcf3-26xf-fw4m

Remediation

  • Fix · CNA Salt (Salt Project) Fixed in 3006.17
  • Fix · CNA Salt (Salt Project) Fixed in 3007.9
  • Fix · GHSA-vcf3-26xf-fw4m salt (PyPI) Fixed in 3006.17 Advisory →
  • Fix · GHSA-vcf3-26xf-fw4m salt (PyPI) Fixed in 3007.9 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Salt — Salt 3006.17 release notes (fix and minimum_auth_version)

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-38621 Salt junos module uses an unsafe YAML loader which may allow unintended code executionPriority LOW 33
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62349
  2. 2026-10-03 Alias added: GHSA-vcf3-26xf-fw4m

References

Advisory 3

Other 3

  • TI-2025-38621 Salt junos module uses an unsafe YAML loader which may allow unintended code execution CVSS 4.0HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences