Executive brief
An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.
Affected products
- PyPI salt
Junglewise Threat Intelligence
CVE-2021-25281: PYSEC-2021-50 - An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus
CVE-2021-25281 · Severity: low · CVSS 3.1 · Published 2021-02-27
Technologies: salt (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1894 - Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload
- PYSEC-2026-1902 - Salt Authentication Protocol Version Downgrade Allows Minion Impersonation
- PYSEC-2026-1896 - Salt's worker process vulnerable to denial of service through file read operation
- PYSEC-2026-1895 - Salt's file contents overwrite the VirtKey class
- PYSEC-2026-1898 - Salt's on demand pillar functionality vulnerable to arbitrary command injections