Vulnerability record · CVE-2020-11651 · published 30 April 2020
CVE-2020-11651: SaltStack Salt master authentication bypass in ClearFuncs
Saltstack · Salt
SaltStack Salt before 2019.2.4 and 3000 before 3000.2 fails to properly validate method calls in the salt-master ClearFuncs class, allowing remote unauthenticated access to certain methods. Those methods can be used to retrieve user tokens from the salt master and run arbitrary commands on salt minions, making it a severe control-plane compromise.
Description
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated remote code execution on the Salt control plane with CVSS 9.8, KEV listing and near-certain EPSS probability.
What it is
SaltStack Salt before 2019.2.4 and 3000 before 3000.2 fails to properly validate method calls in the salt-master ClearFuncs class, allowing remote unauthenticated access to certain methods. Those methods can be used to retrieve user tokens from the salt master and run arbitrary commands on salt minions, making it a severe control-plane compromise.
Impact
An unauthenticated attacker can steal salt master user tokens and execute arbitrary commands across managed minions, effectively taking over the Salt infrastructure and any systems it manages.
Attack surface
Reachable remotely over the network against the salt-master service with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
CISA KEV lists it as exploited with a 2021-11-03 addition, EPSS 30-day probability is 0.96614 (99.881st percentile), and references include public exploit write-ups tagged Exploit.
What to do
- Upgrade Salt to 2019.2.4 or 3000.2 or later as directed by the vendor advisory.
- Apply distribution-specific updates from Debian, Ubuntu, openSUSE and VMware advisories where Salt or bundled components are present.
- Restrict network access to salt-master ports (4505/4506) to trusted management networks only.
- Rotate salt master tokens, keys and any credentials reachable from the master after patching.
- Audit minion command history and master logs for unauthorized command execution.
Detection
- Monitor salt-master logs for unexpected ClearFuncs method calls or authentication anomalies.
- Alert on new or unusual outbound connections from salt-master to minion ports.
- Hunt for unexpected command execution events on minions originating from the master.
- Review network flows to salt-master ports from untrusted or external sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-11651 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "SaltStack Salt Authentication Bypass Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-11651 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-11651), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
