CVE-2025-62349: Salt Package Authentication Protocol Downgrade Vulnerability
Summary
CVE-2025-62349: Salt Authentication Protocol Version Downgrade Allows Minion Impersonation. Affects salt across 2 version ranges.
>= 3006.12, < 3006.17
>= 3007.4, < 3007.9
Fixed in 3006.17 or 3007.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Salt is an open-source configuration management and orchestration tool that enables users to manage and automate the deployment of software and infrastructure. It provides a powerful framework for managing servers, applications, and other resources in a scalable manner. However, it is susceptible to a vulnerability that allows malicious actors to impersonate minions by exploiting an authentication protocol downgrade.
Vulnerability Detail
The vulnerability in Salt arises from a weakness in its authentication protocol that allows a malicious minion to downgrade the authentication process by using an older request payload format. This bypasses newer security features, enabling the attacker to impersonate legitimate minions and circumvent protections that were implemented to address previous security issues. The potential ramifications include unauthorized access to sensitive data and control over the Salt infrastructure.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3006.12, < 3006.173006.17pip install --upgrade "salt==3006.17" -
>= 3007.4, < 3007.93007.9pip install --upgrade "salt==3007.9"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict the use of older request payload formats in your Salt configuration. This can help mitigate the risk of exploitation until the package is updated to a secure version.
Conclusion
In summary, CVE-2025-62349 is a significant vulnerability in the Salt package that allows for minion impersonation through an authentication protocol downgrade. It is crucial to update to the patched versions to safeguard your infrastructure and data.
See every vulnerability recorded for salt →
FAQ
CVE-2025-62349 is a vulnerability in the Salt package that allows malicious minions to impersonate legitimate ones by exploiting an authentication protocol downgrade.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include unauthorized access to sensitive data and the ability for attackers to control Salt-managed infrastructure.
You can update the Salt package by running 'pip install --upgrade salt==3006.17' or 'pip install --upgrade salt==3007.9' in your terminal.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just the Pipfile.lock, without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for salt.
