CVE-2016-3176: Salt PAM External Authentication Bypass
Summary
CVE-2016-3176: Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to Loc... Affects salt across 2 version ranges.
< 2015.5.10
>= 2015.8, < 2015.8.8
Fixed in 2015.5.10 or 2015.8.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Salt is a popular open-source configuration management and remote execution tool. It allows administrators to manage and automate the configuration of multiple systems. The PAM (Pluggable Authentication Modules) external authentication feature in Salt enables users to authenticate using an external service. This vulnerability affects Salt versions before 2015.5.10 and 2015.8.x before 2015.8.8.
Vulnerability Detail
The vulnerability (CVE-2016-3176) in Salt with PAM external authentication enabled allows attackers to bypass the configured authentication service. By passing an alternate service with a command sent to LocalClient, an attacker can circumvent the intended authentication mechanism. This can lead to unauthorized access and potential compromise of the Salt-managed systems.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2015.5.102015.5.10pip install --upgrade "salt==2015.5.10" -
>= 2015.8, < 2015.8.82015.8.8pip install --upgrade "salt==2015.8.8"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the PAM external authentication feature in Salt. This can be achieved by modifying the Salt configuration file and removing or commenting out the relevant configuration options related to PAM authentication.
Conclusion
The vulnerability (CVE-2016-3176) in Salt with PAM external authentication enabled allows attackers to bypass the configured authentication service, potentially leading to unauthorized access and compromise of Salt-managed systems. It is crucial to upgrade to the fixed versions of Salt or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
Salt is an open-source configuration management and remote execution tool used for managing and automating the configuration of multiple systems.
PAM external authentication is a feature in Salt that allows users to authenticate using an external service, such as LDAP or Active Directory.
The vulnerability allows attackers to bypass the configured authentication service in Salt when PAM external authentication is enabled. This can lead to unauthorized access and potential compromise of the Salt-managed systems.
To fix the vulnerability, it is recommended to upgrade to Salt version 2015.5.10 or later, or version 2015.8.8 or later. These versions include the necessary fixes to prevent the bypass of the configured authentication service.
Yes, a temporary workaround is to disable the PAM external authentication feature in Salt by modifying the Salt configuration file and removing or commenting out the relevant configuration options related to PAM authentication.
References
Related vulnerabilities
Recent vulnerabilities recorded for salt.
