GHSA-vcf3-26xf-fw4m
Medium · 6.2CVSS
6.2
EPSS
—
Published
Jan 30, 2026
CISA due date
—
The record
Salt Authentication Protocol Version Downgrade Allows Minion Impersonation
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | salt | 3006.12 | 3006.17 |
| PyPI | salt | 3007.4 | 3007.9 |
Related vulnerabilities
- CVE-2025-62349 Salt contains an authentication protocol version downgrade weakness that can allow a… Same vulnerability
- GHSA-77w2-v593-vxvv Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload Also affects salt
- CVE-2025-62348 Salt's junos execution module contained an unsafe YAML decode/load usage. Also affects salt
- CVE-2023-34049 The Salt-SSH pre-flight option copies the script to the target at a predictable path… Also affects salt
- CVE-2024-22232 A specially crafted url can be created which leads to a directory traversal in the salt… Also affects salt
- CVE-2024-22231 Syndic cache directory creation is vulnerable to a directory traversal attack in salt… Also affects salt
- CVE-2014-3563 Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local… Also affects salt
- CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the… CWE-287