Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade salt-standalone-formulas-configurationUpgrade salt-fish-completionUpgrade salt-cloudUpgrade salt-zsh-completionUpgrade python3-salt-testsuiteUpgrade python3-saltUpgrade salt-apiUpgrade salt-transactional-updateUpgrade saltUpgrade salt-syndicUpgrade salt-docUpgrade salt-sshUpgrade salt-minionUpgrade salt-masterUpgrade salt-bash-completionUpgrade salt-proxy | Dec 5, 2025 | Jul 23, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub