# CVE-2020-25592: SaltStack Salt authentication bypass in salt-netapi

Source: https://junglewise.ai/threats/cve-2020-25592-saltstack-salt-authentication-bypass-in-salt-netapi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-11-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2020-25592 · Severity: low · CVSS 3.1 · Published 2020-11-06

SaltStack Salt is a widely-used open-source infrastructure automation and configuration management platform. The salt-netapi component improperly validates authentication credentials and tokens, allowing an unauthenticated attacker to bypass authentication and execute arbitrary commands via Salt SSH. This could lead to complete compromise of managed systems and data exposure.

Technologies: [salt (PyPI)](https://junglewise.ai/threats/technologies/pypi-salt), [Saltstack Salt](https://junglewise.ai/threats/technologies/salt). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Saltstack](https://junglewise.ai/threats/vendors/saltstack).

## Quick answers

**Is CVE-2020-25592 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-25592 being exploited in the wild.

**How severe is CVE-2020-25592?** Low severity, with a CVSS score of 3.1, published 6 November 2020.

**Which products and versions are affected?** salt (PyPI) ECOSYSTEM:introduced=0,fixed=2015.8.10,introduced=2015.8.11,fixed=2015.8.13,introduced=2016.3.0,fixed=2016.3.4,introduced=2016.3.5,fixed=2016.3.6,introduced=2016.3.7,fixed=2016.3.8,introduced=2016.11.0,fixed=2016.11.3,introduced=2016.11.4,fixed=2016.11.6,introduced=2016.11.7,fixed=2016.11.10,introduced=2017.7.0,fixed=2017.7.4,introduced=2017.7.5,fixed=2017.7.8,introduced=2018.3.0rc1,fixed=2018.3.5,introduced=2019.2.0,fixed=2019.2.5,introduced=3000,fixed=3000.3; Saltstack Salt before 2015.8.13, 2016.3.0 before 2016.3.8, 2016.11.0 before 2016.11.10, 2017.7.0 before 2017.7.8, 2018.3.0 before 2018.3.5, 2019.2.0 before 2019.2.7, 3000.x before 3000.5, 3001.x before 3001.3, 3002.x before 3002.1.

**Is there a fix for CVE-2020-25592?** Yes. salt (PyPI): upgrade to 3000.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-25592 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-25592?** Check whether you run salt (PyPI) or Saltstack Salt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- salt (PyPI): upgrade to 3000.3 or later

  ```sh
  pip install "salt>=3000.3"
  ```


## Technical details

This vulnerability is an authentication bypass (CWE-20: Improper Input Validation) in the salt-netapi REST API component. The flaw allows attackers to bypass eauth credential and token validation without proper authentication, gaining access to invoke Salt SSH commands. The attack vector is network-based and requires no authentication or user interaction. An attacker can leverage this to execute arbitrary commands on systems managed by the affected Salt installation. Patches are available in multiple release branches (2015.8.13, 2016.3.8, 2016.11.10, 2017.7.8, 2018.3.5, 2019.2.7, and later versions).

## Affected products

- SaltStack Salt before 2015.8.13, 2016.3.0 before 2016.3.8, 2016.11.0 before 2016.11.10, 2017.7.0 before 2017.7.8, 2018.3.0 before 2018.3.5, 2019.2.0 before 2019.2.7, 3000.x before 3000.5, 3001.x before 3001.3, 3002.x before 3002.1

## Identifiers

- CVE-2020-25592
- GHSA-29j3-2446-5j4w
- PYSEC-2020-106

## Timeline

- 2020-11-06: disclosed: Vulnerability publicly disclosed
- 2020-11: patched: Patches released across multiple release branches

## References

- [https://docs.saltstack.com/en/latest/topics/releases/index.html](https://docs.saltstack.com/en/latest/topics/releases/index.html)

## Related threats

- [PYSEC-2026-1894 - Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload](https://junglewise.ai/threats/cve-2025-62348-salt-junos-module-vulnerable-to-code-injection-via-specially)
- [PYSEC-2026-1902 - Salt Authentication Protocol Version Downgrade Allows Minion Impersonation](https://junglewise.ai/threats/cve-2025-62349-salt-authentication-protocol-version-downgrade-allows-minion)
- [PYSEC-2026-1896 - Salt's worker process vulnerable to denial of service through file read operation](https://junglewise.ai/threats/cve-2025-22242-salt-s-worker-process-vulnerable-to-denial-of-service-through)
- [PYSEC-2026-1895 - Salt's file contents overwrite the VirtKey class](https://junglewise.ai/threats/cve-2025-22241-salt-s-file-contents-overwrite-the-virtkey-class)
- [PYSEC-2026-1898 - Salt's on demand pillar functionality vulnerable to arbitrary command injections](https://junglewise.ai/threats/cve-2025-22237-salt-s-on-demand-pillar-functionality-vulnerable-to-arbitrary)