Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade salt-cloudUpgrade python3-salt-testsuiteUpgrade salt-standalone-formulas-configurationUpgrade salt-zsh-completionUpgrade python3-saltUpgrade salt-fish-completionUpgrade salt-apiUpgrade salt-transactional-updateUpgrade salt-proxyUpgrade saltUpgrade salt-docUpgrade salt-sshUpgrade salt-minionUpgrade salt-masterUpgrade salt-bash-completionUpgrade salt-syndic | Dec 5, 2025 | Jul 23, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub