CVE-2020-16846
KEVSaltStack Salt Shell Injection Vulnerability
Description
SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedNov 6, 2020
Last modifiedJun 17, 2026
Added to KEVNov 3, 2021
Remediation dueMay 3, 2022
References
- lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.htmlMailing ListThird Party Advisory
- packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.htmlExploitThird Party Advisory
- github.com/saltstack/salt/releasesRelease Notes
- lists.debian.org/debian-lts-announce/2020/12/msg00007.htmlMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2022/01/msg00000.htmlMailing ListThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/Release Notes
- security.gentoo.org/glsa/202011-13Third Party Advisory
- debian.org/security/2021/dsa-4837Mailing ListThird Party Advisory
- saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/Broken LinkVendor Advisory
- zerodayinitiative.com/advisories/ZDI-20-1379/Third Party AdvisoryVDB Entry
- zerodayinitiative.com/advisories/ZDI-20-1380/Third Party AdvisoryVDB Entry
- zerodayinitiative.com/advisories/ZDI-20-1381/Third Party AdvisoryVDB Entry
0 recent articles mention this CVE
89
Risk assessment · Critical
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1637 days
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 99.6% · top 1% of all CVEs
- Weakness
- CWE-78
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.