CVE-2016-9639: Salt Package Deleted Minions Vulnerability
Summary
CVE-2016-9639: Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. Affects salt versions < 2015.8.11. Fixed in 2015.8.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Salt package is a popular configuration management and remote execution tool used for managing and controlling large-scale infrastructure. It allows administrators to automate tasks, deploy software, and manage systems across a network. The package is written in Python and is available on the Python Package Index (PyPI). The vulnerability described here affects versions of Salt prior to 2015.8.11.
Vulnerability Detail
The vulnerability in Salt before 2015.8.11 allows deleted minions to read or write to minions with the same ID due to caching issues. This means that a deleted minion can still access and modify data on other minions with the same ID. This can lead to unauthorized access, data leakage, and potential compromise of the entire Salt infrastructure. The vulnerability originates from improper handling of deleted minions and their associated cached data.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2015.8.11
This is the first release that contains the fix.
pip install --upgrade "salt==2015.8.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of Salt.
Conclusion
The Salt package prior to version 2015.8.11 is vulnerable to a caching issue that allows deleted minions to read or write to minions with the same ID. This can lead to unauthorized access and potential compromise of the Salt infrastructure. It is crucial to upgrade to Salt version 2015.8.11 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your Salt installation is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it and alert you if any open-source vulnerabilities, including this one, are found.
No, this vulnerability requires the attacker to have access to a minion with the same ID as the deleted minion. It cannot be exploited remotely without prior access to the Salt infrastructure.
There have been no public reports of this vulnerability being actively exploited. However, it is crucial to apply the recommended fix to prevent any potential unauthorized access or data leakage.
Minions that were not deleted are not directly affected by this vulnerability. However, if a deleted minion gains unauthorized access to a minion with the same ID, it may be able to perform actions on behalf of the legitimate minion, potentially leading to further compromise.
The best way to mitigate the risk is to promptly apply the recommended fix by upgrading to the patched version of Salt. There are no known temporary workarounds for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for salt.
