Vulnerability record · CVE-2020-25592 · published 6 November 2020
CVE-2020-25592: SaltStack Salt netapi authentication bypass enables Salt SSH invocation
Saltstack · Salt
SaltStack Salt through 3002 fails to properly validate eauth credentials and tokens in salt-netapi. An unauthenticated remote user can bypass authentication and invoke Salt SSH. Because Salt SSH can execute commands on managed hosts, this is a serious control-plane compromise.
Description
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or interaction required and a public exploit reference for arbitrary command execution on managed hosts.
What it is
SaltStack Salt through 3002 fails to properly validate eauth credentials and tokens in salt-netapi. An unauthenticated remote user can bypass authentication and invoke Salt SSH. Because Salt SSH can execute commands on managed hosts, this is a serious control-plane compromise.
Impact
An attacker gains unauthenticated access to the Salt API and can invoke Salt SSH, leading to arbitrary command execution on managed systems under the Salt master's control.
Attack surface
Reached over the network via the salt-netapi interface; the CVSS vector shows no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N). Any exposed Salt API endpoint is a candidate entry point.
Exploitation
Not listed in CISA KEV, but EPSS is 0.577 (99th percentile) and a public Packet Storm entry describes arbitrary command execution, indicating known public exploitation detail.
What to do
- Upgrade Salt to a version after 3002 that fixes the eauth validation flaw.
- Apply vendor patches from Debian, Fedora, Gentoo or openSUSE advisories for packaged Salt.
- Restrict network access to the salt-netapi endpoint to trusted management networks only.
- Disable or tightly limit Salt SSH and external auth backends not in active use.
- Rotate Salt eauth credentials and tokens after patching in case of prior exposure.
Detection
- Monitor Salt API logs for authentication attempts that succeed without valid eauth credentials or tokens.
- Alert on unexpected Salt SSH invocations, especially from unfamiliar source IPs.
- Baseline normal Salt API callers and flag new or anomalous clients hitting the netapi endpoint.
- Review Salt master audit logs for command execution patterns inconsistent with normal orchestration.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-25592 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-25592), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
