# CVE-2022-22934: SaltStack Salt improper verification of cryptographic signature

Source: https://junglewise.ai/threats/cve-2022-22934-saltstack-salt-improper-verification-of-cryptographic-signature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-29. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2022-22934 · Severity: low · CVSS 3.1 · Published 2022-03-29

SaltStack Salt is an open-source infrastructure automation tool used by organizations to manage and provision servers at scale. A flaw in how pillar data (configuration and credentials) is transmitted from the server to clients allows an attacker positioned between them to intercept and substitute arbitrary pillar data without detection. An attacker exploiting this could inject malicious packages, credentials, or keys to compromise client machines.

Technologies: [salt (PyPI)](https://junglewise.ai/threats/technologies/pypi-salt), [Saltstack Salt](https://junglewise.ai/threats/technologies/salt). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Saltstack](https://junglewise.ai/threats/vendors/saltstack).

## Quick answers

**Is CVE-2022-22934 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-22934 being exploited in the wild.

**How severe is CVE-2022-22934?** Low severity, with a CVSS score of 3.1, published 29 March 2022.

**Which products and versions are affected?** salt (PyPI) ECOSYSTEM:introduced=0,fixed=3002.8; Saltstack Salt before 3002.8, 3003.4, 3004.1.

**Is there a fix for CVE-2022-22934?** Yes. salt (PyPI): upgrade to 3002.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-22934 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2022-22934?** Check whether you run salt (PyPI) or Saltstack Salt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- salt (PyPI): upgrade to 3002.8 or later

  ```sh
  pip install "salt>=3002.8"
  ```


## Technical details

SaltStack Salt versions before 3002.8, 3003.4, and 3004.1 fail to cryptographically sign pillar data with the minion's public key, violating the integrity requirement for sensitive configuration. The vulnerability exists in the symmetric channel protocol variation used for pillar messages: neither the freshly generated encryption key nor the message payload is authenticated as originating from the server, enabling a man-in-the-middle attacker to forge and inject arbitrary pillar data if they know the client's public key (which is broadcast during key exchange). This affects all prior versions up to the fixed releases. The fix adds a server signature to pillar messages to prevent spoofing.

## Affected products

- SaltStack Salt before 3002.8, 3003.4, 3004.1

## Identifiers

- CVE-2022-22934
- GHSA-2q4g-wfm6-5fpm
- PYSEC-2022-171

## Timeline

- 2022-03-30: disclosed
- 2022-03-28: patched: Patch released adding server signature to pillar messages

## References

- [https://blog.cloudflare.com/future-proofing-saltstack](https://blog.cloudflare.com/future-proofing-saltstack)

## Related threats

- [PYSEC-2026-1894 - Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload](https://junglewise.ai/threats/cve-2025-62348-salt-junos-module-vulnerable-to-code-injection-via-specially)
- [PYSEC-2026-1902 - Salt Authentication Protocol Version Downgrade Allows Minion Impersonation](https://junglewise.ai/threats/cve-2025-62349-salt-authentication-protocol-version-downgrade-allows-minion)
- [PYSEC-2026-1896 - Salt's worker process vulnerable to denial of service through file read operation](https://junglewise.ai/threats/cve-2025-22242-salt-s-worker-process-vulnerable-to-denial-of-service-through)
- [PYSEC-2026-1895 - Salt's file contents overwrite the VirtKey class](https://junglewise.ai/threats/cve-2025-22241-salt-s-file-contents-overwrite-the-virtkey-class)
- [PYSEC-2026-1898 - Salt's on demand pillar functionality vulnerable to arbitrary command injections](https://junglewise.ai/threats/cve-2025-22237-salt-s-on-demand-pillar-functionality-vulnerable-to-arbitrary)