CVE-2015-6941: Password Information Leakage in Salt
Summary
CVE-2015-6941: win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs. Affects salt across 3 version ranges.
>= 2015.5, < 2015.5.6
>= 2015.8, < 2015.8.1
< c0689e32154c41f59840ae10ffc5fbfa30618710
Fixed in 2015.5.6 or 2015.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Salt is a popular open-source configuration management and remote execution framework. It is used for managing and automating the configuration of servers and other network devices. Salt provides a client-server architecture where the server, known as the Salt Master, manages a group of Salt Minions, which are the target devices being configured. The vulnerability in question affects versions 2015.5.x before 2015.5.6 and 2015.8.x before 2015.8.1 of Salt. These versions include the 'win_useradd' module, 'salt-cloud', and the Linode driver. The vulnerability allows password information to be leaked in debug logs.
Vulnerability Detail
The vulnerability arises due to the improper handling of password information in debug logs. When certain actions are performed using the 'win_useradd' module, 'salt-cloud', or the Linode driver, the password information is inadvertently logged in the debug logs. This can lead to the exposure of sensitive information, potentially allowing unauthorized access to systems or accounts. The vulnerability was identified as CVE-2015-6941.
How To Fix
Latest published version: 3008.3.0 as of 22 Oct 2026
pip install --upgrade "salt==3008.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2015.5, < 2015.5.62015.5.6pip install --upgrade "salt==2015.5.6" -
>= 2015.8, < 2015.8.12015.8.1pip install --upgrade "salt==2015.8.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can manually modify the debug log configuration to exclude the logging of password information. This can be achieved by adjusting the logging settings in the Salt configuration file. Here is an example of how to modify the 'salt-master' configuration file to disable password logging:
# Disable password logging in debug logs
log_level_logfile: warning
Conclusion
The vulnerability in Salt versions 2015.5.x before 2015.5.6 and 2015.8.x before 2015.8.1 allows password information to be leaked in debug logs. This can potentially lead to unauthorized access to systems or accounts. Users should upgrade to the fixed versions (2015.5.6 or 2015.8.1) and ensure that debug logging is properly configured. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for salt →
FAQ
Salt is an open-source configuration management and remote execution framework used for managing and automating the configuration of servers and network devices.
Versions 2015.5.x before 2015.5.6 and 2015.8.x before 2015.8.1 of Salt are affected.
The vulnerability can lead to the exposure of password information in debug logs, potentially allowing unauthorized access to systems or accounts.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Salt (2015.5.6 or 2015.8.1).
Yes, users can modify the debug log configuration to exclude the logging of password information. Details can be found in the 'workaround' section.
Related vulnerabilities
Recent vulnerabilities recorded for salt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
