GHSA-vcf3-26xf-fw4m

Salt Authentication Protocol Version Downgrade Allows Minion Impersonation

Source: GitHub Advisory Database (reviewed) High CVE-2025-62349

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	salt	>= 3006.12, < 3006.17	3006.17
PyPI	salt	>= 3007.4, < 3007.9	3007.9

Details

As written in the advisory (Markdown source, shown as plain text).

Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-62349 advisory
https://github.com/saltstack/salt/issues/68467 web
https://github.com/saltstack/salt/commit/3d5708acae16d039a1e2b5529c8e14a0d3255611 web
https://docs.saltproject.io/en/latest/topics/releases/3006.17.html web
https://docs.saltproject.io/en/latest/topics/releases/3007.9.html web
https://github.com/saltstack/salt package